PDF static analysis report

Static analysis result for SHA-256 ab2245e3dff4d9d9…

SUSPICIOUS

PDF

928.5 KB First seen: 2026-05-09
MD5: dbdd6620c2d81e855a28f3349469fa4c SHA-1: d0faafb5c03755414195b91bb46342cd69109fb0 SHA-256: ab2245e3dff4d9d96045ba0d08f0eb67b718482dcf44bd0e774a438dc3d444b9
44 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains embedded JavaScript and multiple heuristics indicate the presence of script payloads and external URIs. One heuristic specifically flags a URL shortener, http://www.bit.ly/flask-web-dev, which is a common lure for phishing or malware delivery. The document body contains benign URLs related to O'Reilly books, but the embedded script and URL shortener suggest a malicious intent to redirect the user. The embedded scripts are too obfuscated to determine their exact function, but the overall pattern suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0052

Heuristics 4

  • Embedded script payload in PDF stream medium PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain an HTML/XFA <script> tag without accompanying Windows shell-execution primitives — common in accessible XFA forms but worth surfacing for analyst review.
  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/miguelgrinberg/flasky In PDF document text
    • https://github.com/miguelgrinberg/flasky/compare/2a...2bIn PDF document text
    • http://a.b.c.d:5000In PDF document text
    • http://wtforms.simplecodes.com/In PDF document text
    • http://www.celeryproject.org/In PDF document text
    • http://127.0.0.1:5000/In PDF document text
    • http://www.example.com\240In PDF document text
    • http://localhost:5000/In PDF document text
    • http://localhost:5000/user/johnIn PDF document text
    • http://localhost:5000/static/css/styles.cssIn PDF document text
    • http://my.safaribooksonline.com/?portal=oreillyPDF link annotation
    • http://oreilly.com/catalog/errata.csp?isbn=9781449372620In PDF document text
    • http://flask.pocoo.orgIn PDF document text
    • http://git-scm.comIn PDF document text
    • http://www.safaribooksonline.com/contentIn PDF document text
    • http://www.safaribooksonline.com/subscriptionsIn PDF document text
    • http://www.safaribooksonline.com/organizations-teamsIn PDF document text
    • http://www.safaribooksonline.com/governmentIn PDF document text
    • http://www.safaribooksonline.com/individualsIn PDF document text
    • http://www.safaribooksonline.com/publishersIn PDF document text
    • http://www.safaribooksonline.com/In PDF document text
    • http://www.bit.ly/flask-web-devIn PDF document text
    • http://www.oreilly.comIn PDF document text
    • http://facebook.com/oreillyIn PDF document text
    • http://twitter.com/oreillymediaIn PDF document text
    • http://www.youtube.com/oreillymediaIn PDF document text
    • http://flask.pocoo.org/In PDF document text
    • http://werkzeug.pocoo.org/In PDF document text
    • http://jinja.pocoo.org/In PDF document text
    • http://bit.ly/pip-installIn PDF document text
    • http://bit.ly/jinja-filtersIn PDF document text
    • http://getbootstrap.comIn PDF document text
    • http://getbootstrap.com/In PDF document text
    • http://momentjs.comIn PDF document text
    • http://momentjs.com/docs/#/displaying/In PDF document text
    • http://bit.ly/datepackIn PDF document text
    • http://pythonhosted.org/Flask-WTF/In PDF document text
    • http://pythonhosted.org/Flask-SQLAlchemy/In PDF document text
    • http://www.sqlalchemy.org/In PDF document text
    • http://docs.sqlalchemy.orgIn PDF document text
    • http://bit.ly/alembic-docIn PDF document text
    • http://bit.ly/fl-migrateIn PDF document text
    • http://www.example.comIn PDF document text
    • http://www.facebook.com/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 29

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0000ac64.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xAC64 557168 bytes
SHA-256: 4855b8fabb96bdc6495d45d089bb8c8efb1ae18389e0dc9e75a5f701a9c0b662
stream_031_off00070662.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x70662 8348 bytes
SHA-256: 45302c307882ae080e630645d8e77767b08b33e112b1c3eacb8ee42497b3e787
stream_032_off000713b4.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x713B4 7371 bytes
SHA-256: 874ff17057b4452648572af5e50e4a24113caee5d0b5d12c3d6ab812645b724d
stream_033_off0007209b.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7209B 5968 bytes
SHA-256: 3ff7d86860c4bc16f875f33dc715b0378e2d353bdb6b68bd3b85f482bdad866f
stream_035_off000789f3.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x789F3 6553 bytes
SHA-256: 33ac9c4873e112ddd35dc4a2aab358b88b0c63c245595865c857a7b297dcd157
stream_036_off00079421.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x79421 3945 bytes
SHA-256: a8cc46d076b2f7fc70a99a1f3dcce52ac31c366f9fbf0541be0121beea9f9610
stream_039_off00081c04.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x81C04 9133 bytes
SHA-256: 440c4baf992cbad79088dbd286d89abf3a183512918790d6449e9112e3ff72b3
stream_040_off00082923.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x82923 5542 bytes
SHA-256: b270c5ef684e63a58ec87f4214fb4f4be992018f6314d146c4ab013260f5ca8f
stream_041_off00083388.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x83388 7334 bytes
SHA-256: 19c5ff65d5f9a5701a68a3dc621afc9e549f9bffbd9a4900b9a289fc42dcd796
stream_042_off00083f06.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x83F06 5180 bytes
SHA-256: eb18d3910fd09fd1608f51b7109e37504f7b3dbd061b28cbc6939b1b6a4c4422
stream_043_off00084902.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x84902 7035 bytes
SHA-256: 6f63907b5bc14644c2d94b8a87c3a16acf34fd3b53d06be5826bb47a83e6c97f
stream_047_off00086242.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x86242 6365 bytes
SHA-256: e3cf48103b8a6f5b12606a5ddf7c340089d83b01fc08d44976fe5b31b1230951
stream_055_off000930d5.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x930D5 6346 bytes
SHA-256: 05c617300047354b9b1fd242dbae74e727b978f913f379a728cea35e0feaa885
stream_059_off0009cfec.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9CFEC 7889 bytes
SHA-256: b7454b2beaeb416a6c4ce7568bc26cba3eb7a1f47d6505921b0febf3cc67727e
stream_061_off0009ea24.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9EA24 6801 bytes
SHA-256: f9c3370f8daf377eb38fcf86bf03dbf2948d643636fe203df0f55839f3e18415
stream_065_off000a0c73.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA0C73 8690 bytes
SHA-256: 4de60de37b785f77344fc034d2cf671edd300e19f0c23fee36c6d649069d7cd6
stream_068_off000a30fc.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA30FC 7424 bytes
SHA-256: bca7e62e5f4be43531c7c70497bc233467b68ab9bc9981f196462b452ea7c64f
stream_069_off000a3cad.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA3CAD 8355 bytes
SHA-256: 8eb5ecd97753ea8342df0b5a2b7645f48a20d812a3984d46190a761653e4e7bd
stream_071_off000a5016.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA5016 866538 bytes
SHA-256: eeb99a307487ea2e935096a2450c387a725dd27ffcc0748bee28a407c6a5c611
stream_074_off000b58ca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB58CA 905234 bytes
SHA-256: 095dbc91e04779f759c27dc53ba167bc58949a5a98fe4cc36bdebefc6671b14b
stream_075_off000be1ce.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBE1CE 10136 bytes
SHA-256: 789f7a7b04bb6096b826e022de797b52e5f26e94f0d08dc0e4259b3a5f72607f
stream_076_off000bf077.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBF077 9958 bytes
SHA-256: bb3aa2222bc802fd82a3c19f09f008f0aefaf8fa14ac18b34c16d7308f3d8b4d
stream_078_off000c059b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC059B 999104 bytes
SHA-256: f9494a0aa1738029a2c633ad90ad2582880dd49317b2db4925a031fe79446495
stream_095_off000dae59.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDAE59 11660 bytes
SHA-256: 87785b486f4226e7d2f261ad2912995ec2412b2de8572c2ae6bf9748947a2b44
stream_104_off000e06c6.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE06C6 11831 bytes
SHA-256: ecc079e259d3a9eba31de6933f522e4da1a2b3429a9a659473152511367708d1
stream_106_off000e2119.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE2119 8370 bytes
SHA-256: 19f8da8d9f510cc5e0159a92cc0c1e20cbad17af2898d8d92ca5d04455abe2e9
stream_111_off000e48a9.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE48A9 8305 bytes
SHA-256: 2fa724b5a6a9f51a49efc48968b4c191fc68b6126adce3cb93a59ad277d3fcad
stream_112_off000e5553.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE5553 7214 bytes
SHA-256: 000f12d4cea53f46ac8f9ee9820733bf8a63ddb41e5ac66cc108438914a7734c
stream_115_off000e7696.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE7696 8764 bytes
SHA-256: 821ad0a528b3dceb57d07efb2fc3436b483b666d7fa23ea3a78adde84d2b9e1f

Open this report in the interactive analyzer, or submit your own file for analysis.