Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8f74eece77752de…

MALICIOUS

PDF

235.8 KB Created: 2010-02-09 19:21:37 Authoring application: Joomla! 1.5 - Open Source Content Management (via TCPDF 2.5.000_PHP4 (http://www.tcpdf.org)) First seen: 2026-05-10
MD5: 8027d15373d82e3887e5c927810c4dc2 SHA-1: a2156ebeb07a773afcf7893404ba966cb942f93d SHA-256: a8f74eece77752de2e025b373093b295698d0765e7e2d3a8c955a87d3be42682
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a hidden HTML iframe, a common technique for redirecting users to malicious sites. The embedded URLs, such as http://fuadrenal.com/lib/index.php, are likely part of this redirection chain. While no scripts were extracted, the presence of the hidden iframe and the suspicious URLs strongly suggest a malicious intent, possibly for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9482

Heuristics 2

  • PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME
    PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fuadrenal.com/lib/index.php In PDF document text
    • http://reycross.com/lib/index.phpIn PDF document text
    • http://odmarco.com/lib/index.phpIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off0000049b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49B 91432 bytes
SHA-256: 5b0765156a7522e1b20f16cb911bf3a03d568d8ee9f5cab18481d8449fa81040
stream_002_off0000b9ed.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB9ED 264072 bytes
SHA-256: a5337ef1f5a0dfe4dc8fa6b4f3ef847a53624800b5928a0eeef5b888ceecaabc

Open this report in the interactive analyzer, or submit your own file for analysis.