Malicious PDF — malware analysis report

Static analysis result for SHA-256 875382c5cfe056e5…

MALICIOUS

PDF

25.7 KB First seen: 2026-05-30
MD5: 3c9f8d4f0d77ef0c6da93d953a3505ab SHA-1: 513ffaba068e604609e22e3b53a109a8f39d37bb SHA-256: 875382c5cfe056e5e77aee7a8bcb418b5cc1c4e8db63a3d704a6a94b2591194f
102 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0072

Heuristics 3

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • Clickable URL embeds a recipient email address as a tracking parameter high PDF_URL_RECIPIENT_EMAIL_PARAM
    PDF has a clickable HTTP(S) action whose URL carries a recipient email address as a query parameter (e.g. '?e=victim@example.com') on a host that is not known-good. Phishing kits stamp the target's address into the link so the landing page pre-fills the credential form and tracks the open per recipient; a delivered legitimate link rarely carries the recipient's address in cleartext. Complements PDF_URL_MAILMERGE_PLACEHOLDER, which catches the unrendered token.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://hakumonkai.org/fukkou/ref.php?url=https://vets4pets.nz/public/go.php?email=kasper.soltau@ultrabulk.com In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
🗂 Part of campaign: shared payload 99ad8546da 13 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000bd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD2 19348 bytes
SHA-256: 86290a0dea27d3a9c402b49ed59874aefc65355b766fab34eb2902eb796ca517
font_01_sfnt_off000033cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33CF 15892 bytes
SHA-256: 99ad8546dad29e7bf686b854933af3e4868c1b561453de5b001ef0244aae4174
font_02_sfnt_off00004ebd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4EBD 13532 bytes
SHA-256: d9b7e4694a62f4cc2dc10cb17c4d45e5943b9ae0da3fc96fd732b2b28ab45ce4

Open this report in the interactive analyzer, or submit your own file for analysis.