Malicious PDF — malware analysis report

Static analysis result for SHA-256 81ec61a49b5fcc4e…

MALICIOUS

PDF

9.97 MB First seen: 2026-05-13
MD5: 3e97bd9b3eaae9abb0617ec4c0941efd SHA-1: ed597775cf6c632d958731a841edcff8c24b61b2 SHA-256: 81ec61a49b5fcc4e696974798b5e0d3582a297e9c6beaf95d56839b514e064f5
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF is encrypted and contains an OpenAction, a common technique to conceal malicious content from static analysis. The ML classifier and high stream count heuristics further indicate malicious intent. The presence of embedded font streams, some with high entropy and shellcode-like strings, suggests these are used to deliver a payload. While no specific URLs are confirmed malicious, the overall structure points to a downloader or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5568

Heuristics 5

  • Encrypted PDF carries /OpenAction — payload hidden from static analysis high PDF_ENCRYPTED_WITH_JS
    PDF declares /Encrypt and also references an executable trigger (/OpenAction). Document encryption hides the JavaScript body and stream contents from static scanners — combined with auto-execution indicators this is a known evasion pattern used to deliver weaponised JavaScript that the analyst cannot inspect without the decryption key.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/joelgrus/data-science-from-scratch In PDF document text
    • https://raw.githubusercontent.com/In PDF document text
    • http://joel.house.comIn PDF document text
    • https://api.github.com/users/{github_user}/reposIn PDF document text
    • http://oreilly.comIn PDF document text
    • http://oreilly.com/catalog/errata.csp?isbn=9781492041139In PDF document text
    • http://bit.ly/data-science-from-scratch-2eIn PDF document text
    • http://www.oreilly.comIn PDF document text
    • http://facebook.com/oreillyIn PDF document text
    • http://twitter.com/oreillymediaIn PDF document text
    • http://www.youtube.com/oreillymediaIn PDF document text
    • https://www.nytimes.com/In PDF document text
    • https://www.house.gov/representativesIn PDF document text
    • https://jayapal.house.govIn PDF document text
    • http://joel.house.govIn PDF document text
    • https://joel.house.govIn PDF document text
    • http://joel.house.gov/In PDF document text
    • https://joel.house.gov/In PDF document text
    • https://joel.house.gov/biographyIn PDF document text
    • https://developer.twitter.com/In PDF document text
    • http://t.co/HsF9Q0dShPIn PDF document text
    • http://t.co/6hcHUz2PHMIn PDF document text
    • http://news.cnet.com/2100-1001-202143.htmlIn PDF document text
    • http://money.cnn.com/2000/09/29/markets/techwrap/In PDF document text
    • https://archive.ics.uci.edu/ml/datasets/irisIn PDF document text
    • https://archive.ics.uci.edu/ml/machine-learning-databases/iris/iris.dataIn PDF document text
    • https://spamassassin.apache.org/old/publiccorpusIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off0059010f.bin pdf-font-stream PDF embedded font (cff) at offset 0x59010F 192734 bytes
SHA-256: 22a5d0c4879eeff4bdd5f78415e2a52cd64c379a8a39711df62106e7b562b0a4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.50, consistent with packed or encrypted content.
font_01_cff_off005b56ee.bin pdf-font-stream PDF embedded font (cff) at offset 0x5B56EE 62885 bytes
SHA-256: f52725423462ecafe59c801c44a581ab33b9c606ba7eb9d21453d4b5eaf6ba56
font_02_cff_off005c036d.bin pdf-font-stream PDF embedded font (cff) at offset 0x5C036D 63981 bytes
SHA-256: 6126180eb1bfe08b11f66956f20bfd7b3ff0ebe5616877b731282f70e060cb2f
font_03_cff_off005cb31b.bin pdf-font-stream PDF embedded font (cff) at offset 0x5CB31B 161144 bytes
SHA-256: 3c192bf3b680dfb1a05b681fb430492c0ba86219b2d769676727acb41e79b407
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.46, consistent with packed or encrypted content.
font_04_cff_off005ea1f7.bin pdf-font-stream PDF embedded font (cff) at offset 0x5EA1F7 146060 bytes
SHA-256: 5a0aa410312f0ed567f4a7f1455cadfcaddf93b187426b04e5804ed4ff85fa11
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.48, consistent with packed or encrypted content.
font_05_cff_off00605f41.bin pdf-font-stream PDF embedded font (cff) at offset 0x605F41 193128 bytes
SHA-256: 937783e48a589fb77121464393a21ad9b539c8b8b9255f94ac0c30fa2a7ce9fc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.49, consistent with packed or encrypted content.
font_06_sfnt_off0062b59d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62B59D 145926 bytes
SHA-256: a5e553619c64040de729eb893f989e778b7d8cbcf58ac34748af4b486cf8eae3
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis recovered command string(s): CscriptDscriptu1D4A0u1D4A1Gscriptu1D4A3u1D4A4JscriptKscriptu1D4A7u1D4A8NscriptOscriptPscriptQscriptu1D4ADSscriptTscriptUscriptVscriptWscriptXscrip, cscriptdscriptu1D4BAfscriptu1D4BChscriptiscriptj
font_07_cff_off0063859d.bin pdf-font-stream PDF embedded font (cff) at offset 0x63859D 80297 bytes
SHA-256: 10901fc70ef9eedd09a7c7f4ba361b2d80b749f60cd817dfa931a6ef3008b781
font_08_cff_off0064705a.bin pdf-font-stream PDF embedded font (cff) at offset 0x64705A 83604 bytes
SHA-256: 29fe7a6bf39d6b859298ff31f255e4808c97dd9bc0037c8c95388ec100dfa4f2
font_09_cff_off006564af.bin pdf-font-stream PDF embedded font (cff) at offset 0x6564AF 78131 bytes
SHA-256: 40ea9bd015254416e38a29668d8acd05e1f059c7850eb85aa3c06d27117d2353
font_10_cff_off006bb636.bin pdf-font-stream PDF embedded font (cff) at offset 0x6BB636 2524 bytes
SHA-256: 5e1335cc92310d260d26a4ae7b1604c5d013214a68d5069c9ce134eeac129e5e
font_11_cff_off006bc18d.bin pdf-font-stream PDF embedded font (cff) at offset 0x6BC18D 2004 bytes
SHA-256: 0481a80e3235964fe1a63572912b688222cd40b20c9dd7f3db5b598170c2f549
font_12_cff_off006bc9af.bin pdf-font-stream PDF embedded font (cff) at offset 0x6BC9AF 1160 bytes
SHA-256: 115ea864883423988049bbe336547a9874d872e0e3002dc9930f474a1632069b

Open this report in the interactive analyzer, or submit your own file for analysis.