Malicious PDF — malware analysis report

Static analysis result for SHA-256 b56035e4860f7433…

MALICIOUS

PDF

14.18 MB Authoring application: Adobe Illustrator 16.0 First seen: 2026-05-16
MD5: 7a4942a59415a7c3f594d085c8152580 SHA-1: e16f0a7adad117ff4331fbb0888d8957b36e28e6 SHA-256: b56035e4860f7433a517c609fae82ccb5aa3199b3453edd04f7dd352bc3351eb
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a callback phishing lure, instructing the user to call a phone number in a context of billing or security issues. While no scripts were directly extracted, the ML classifier and the presence of numerous streams suggest obfuscation and malicious intent. The document body itself discusses art and programming books, which appears to be a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7412

Heuristics 5

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://doughellmann.com/blog/the-python-3-standard-library-by-example/ In PDF document text
    • http://pythex.orgIn PDF document text
    • http://jtauber.com/blog/2008/02/27/evolution_of_default_dictionaries_in_python/In PDF document text
    • http://talkpython.fm/episodes/rssIn PDF document text
    • http://nedbatchelder.com/blog/201601/isolated_memoize.htmlIn PDF document text
    • http://labix.org/python-dateutilIn PDF document text
    • https://pymotw.com/3/In PDF document text
    • http://www.standardml.org/Basis/In PDF document text
    • http://www.wefearchange.org/2013/05/resource-management-in-python-33-or.htmlIn PDF document text
    • http://www.johndcook.com/blog/2009/07/21/ieee-arithmetic-python/In PDF document text
    • http://www.mathstips.com/statistics/median-for-discrete-and-continuous-frequency-type.htmlIn PDF document text
    • http://effbot.org/zone/unicode-objects.htmIn PDF document text
    • http://evanjones.ca/python-utf8.htmlIn PDF document text
    • http://www.skymind.com/%7Eocrow/python_string/In PDF document text
    • http://peadrop.com/blog/2007/06/18/pickle-an-interesting-stack-language/In PDF document text
    • https://bitbucket.org/dhellmann/feedcacheIn PDF document text
    • https://talkpython.fm/episodes/rssIn PDF document text
    • https://talkpython.fmIn PDF document text
    • http://podcastinit.comIn PDF document text
    • http://effbot.org/zone/element-index.htmIn PDF document text
    • http://www.opml.orgIn PDF document text
    • http://effbot.org/zone/element-xpath.htmIn PDF document text
    • http://www.bzip.orgIn PDF document text
    • http://www.pkware.com/documents/casestudies/APPNOTE.TXTIn PDF document text
    • http://www.voidspace.org.uk/python/weblog/arch_d7_2006_10_07.shtml#e497In PDF document text
    • http://www.giantflyingsaucer.com/blog/?p=5557In PDF document text
    • http://aosabook.org/en/500L/a-web-crawler-with-asyncio-coroutines.htmlIn PDF document text
    • http://www.getoffmalawn.com/blog/playing-with-asyncioIn PDF document text
    • http://www.dabeaz.com/coroutines/In PDF document text
    • http://www.snarky.ca/how-the-heck-does-async-await-work-in-python-3-5In PDF document text
    • https://www.mybank.comIn PDF document text
    • http://localhost:8080/In PDF document text
    • https://pymotw.com/In PDF document text
    • https://pymotw.com/sitemap.xmlIn PDF document text
    • https://pymotw.com/True:/PyMOTW/True:https://pymotw.com/PyMOTW/False:/admin/False:https://pymotw.com/admin/False:/downloads/PyMOTW-1.92.tar.gzIn PDF document text
    • https://pymotw.com/downloads/PyMOTW-1.92.tar.gzIn PDF document text
    • https://github.com/dhellmann/whatthewhatIn PDF document text
    • http://www.doughellmann.comIn PDF document text
    • http://localhost:9000In PDF document text
    • http://www.qmail.org/man/man5/mbox.htmlIn PDF document text
    • http://www.qmail.org/man/man5/maildir.htmlIn PDF document text
    • http://snipplr.com/view/7955/imap-backup-script/In PDF document text
    • http://imapclient.freshfoo.com/In PDF document text
    • http://www.offlineimap.orgIn PDF document text
    • http://sandbox.effbot.org/librarybook/readline.htmIn PDF document text
    • http://localhost:8080/bugsIn PDF document text
    • http://nedbatchelder.com/code/modules/coverage.htmlIn PDF document text
    • http://darcs.idyll.org/~t/projects/figleaf/doc/In PDF document text
    • https://lists.gt.net/python/dev/802870In PDF document text
    • https://github.com/dhellmann/smileyIn PDF document text
    +439 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0002fbdd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2FBDD 557168 bytes
SHA-256: 35f401731df11a4eba3502af632e51d68bc394bcb7d34632a331c1ba3f4a0bf6
icc_02_off00124286.icc pdf-icc-profile PDF ICC profile at offset 0x124286 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0008ef5f.bin pdf-font-stream PDF embedded font (cff) at offset 0x8EF5F 2308 bytes
SHA-256: a2c257936d4367ffa1dbc43bf9c0c0e03c24488d2f2433cae9c9c4b2c112c216
font_01_cff_off0008fd9c.bin pdf-font-stream PDF embedded font (cff) at offset 0x8FD9C 5842 bytes
SHA-256: 53a469b3be28ff764347f57dfca811655c960ce9a28790d062fa90b20edde61c
font_02_cff_off0010580d.bin pdf-font-stream PDF embedded font (cff) at offset 0x10580D 2665 bytes
SHA-256: 18f4789445e22d3ea394033b92932a9844da706c6f89e04eb6397bdec1c9e03a
font_03_cff_off00106a6e.bin pdf-font-stream PDF embedded font (cff) at offset 0x106A6E 3077 bytes
SHA-256: b3ef24bd1a9c24e3daf5356afab557ca358b09ab7b355605d99f2ea8a514aced
font_04_sfnt_off00107a2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107A2A 10326 bytes
SHA-256: c43224e768a39a8c2f320a5836c44902f2a3ee7fdd1db7f108c2be31a0927d08
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x06
font_05_cff_off0011c733.bin pdf-font-stream PDF embedded font (cff) at offset 0x11C733 11486 bytes
SHA-256: 487bc0f9cd8c12151da6c71c9b230979aec7f9679698a53f95f0694625ab25d0
font_06_cff_off0011f16f.bin pdf-font-stream PDF embedded font (cff) at offset 0x11F16F 309 bytes
SHA-256: d7be46fdaf1fd5c7e514161b5f6fb304c88311524514d95db5ee783f69011204
font_07_cff_off0011fe5b.bin pdf-font-stream PDF embedded font (cff) at offset 0x11FE5B 10445 bytes
SHA-256: 0438700dfad8fd00697953a23ec6e8ea40f9566d02e4eefb8d647877970095e7
font_08_cff_off00123189.bin pdf-font-stream PDF embedded font (cff) at offset 0x123189 2787 bytes
SHA-256: 2b4fa3dfe35d8705864dc2177324035b3862bca54d3f9b24f3069f1dcf0215b6
font_09_sfnt_off00124d78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124D78 24420 bytes
SHA-256: 1e1032c2b85d078406acde410a7dfe83d3d3a6165c63dacdbeb98bbb994309c8
font_10_cff_off00128cba.bin pdf-font-stream PDF embedded font (cff) at offset 0x128CBA 3164 bytes
SHA-256: 9824da1b78d7e7573d9174dbd20e80a8bde9cd66cb442aa8534b048c2ef8da6c
font_11_cff_off00129a93.bin pdf-font-stream PDF embedded font (cff) at offset 0x129A93 2756 bytes
SHA-256: e2966f4adc7ae972dd7b43d6eb0b825c09fa5551a4785964b75532cdd0680ca5
font_12_cff_off0012a6b7.bin pdf-font-stream PDF embedded font (cff) at offset 0x12A6B7 8868 bytes
SHA-256: 82070a4c8ab69b43986f9ed70e17893e474719bd6fa9ee9d4617d5e59012e5d2
font_13_cff_off0012c3ad.bin pdf-font-stream PDF embedded font (cff) at offset 0x12C3AD 5241 bytes
SHA-256: d090ebbfacb8fe8e2af8809907d253ad3212749e7feaa659129e9df555722753
font_14_cff_off0012e8c3.bin pdf-font-stream PDF embedded font (cff) at offset 0x12E8C3 6484 bytes
SHA-256: 07ced40d20ae9add36cddefe9fb34b8213f5a7618e87235d7a662ab90b13631c
font_15_sfnt_off0014a346.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A346 16003 bytes
SHA-256: 75e075f401edb34800df464b27ae64ca75fba7bc94c275a6661d9e3c203b9aca
font_16_cff_off001660ff.bin pdf-font-stream PDF embedded font (cff) at offset 0x1660FF 8785 bytes
SHA-256: d4009dbdde8a82f3e7ba1ef1b54dbdc58660d524ac99aa68c0918d0af5a8c829
font_17_cff_off001711d1.bin pdf-font-stream PDF embedded font (cff) at offset 0x1711D1 3437 bytes
SHA-256: 74396f94ccebc9f51d06b0d2310a4d0775e72cbd1a0f9ec3c11049b1491abf54
font_18_sfnt_off001745f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1745F1 25719 bytes
SHA-256: 6182ac82c0e7a427fd388fe8c50618224f53c3342c0e763b7034ab9e57a080d8
font_19_sfnt_off0017894e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17894E 14664 bytes
SHA-256: bee7dc7c9ea73e064046ac048e8521cc54173ce057ce7a070a54ee288eda99af
font_20_cff_off0017c53f.bin pdf-font-stream PDF embedded font (cff) at offset 0x17C53F 1688 bytes
SHA-256: 1fe45e8bb8740ede212edbaca011506de5a3871d9849fcae773effd24f1ad962
font_21_cff_off0017d15e.bin pdf-font-stream PDF embedded font (cff) at offset 0x17D15E 1698 bytes
SHA-256: c6e58a5579fe09f68349cd67a801a09a1572e8f18fe569fe4da3c59999f347dc
font_22_cff_off00181fbe.bin pdf-font-stream PDF embedded font (cff) at offset 0x181FBE 6572 bytes
SHA-256: d21d71633461bf2d59e9d0b6fed01763e6b7bec36da0829e6dd16a4c64fb6c77
font_23_cff_off00183d6f.bin pdf-font-stream PDF embedded font (cff) at offset 0x183D6F 7650 bytes
SHA-256: 1b8f22e825dc7dfd2170de0d42b1d7a9ab40275daa20537e8fc1bf673bf217f0
font_24_cff_off001937fe.bin pdf-font-stream PDF embedded font (cff) at offset 0x1937FE 9181 bytes
SHA-256: 5aa3d3763fff1e1cd8cca2ae3d269adbce8ef7e83530774cbccdaa47081fcca9
font_25_cff_off00195cc8.bin pdf-font-stream PDF embedded font (cff) at offset 0x195CC8 4315 bytes
SHA-256: b9de28b7ecb4a15efc551a65e9d2dc071bb367c14fb6d4a6ded12815972040c4
font_26_sfnt_off001b6ca9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B6CA9 24123 bytes
SHA-256: 2bb2feff91afca14849bc8ff19d0b27d1f565533b331ab7da4e294e2e2ee75ec
font_27_sfnt_off001bc587.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BC587 15028 bytes
SHA-256: 0b2f5f18114194cd7d08a2330f7f849471c067bba79c1b5ce20f1d28573afea5
font_28_cff_off001d6685.bin pdf-font-stream PDF embedded font (cff) at offset 0x1D6685 1512 bytes
SHA-256: 24b42ac65840a729617675b21b0e988d668d709c353fdb6a5bddc506d0cafb5a
font_29_cff_off001d83a6.bin pdf-font-stream PDF embedded font (cff) at offset 0x1D83A6 1434 bytes
SHA-256: 8c8ac93a0fa0692c59fcf431c6331d104174a2c424afbd4434cf5b0d714150cf

Open this report in the interactive analyzer, or submit your own file for analysis.