Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9a6513ed5183bae…

MALICIOUS

PDF

99.5 KB Created: 2026-05-28 10:54:16 +02:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-11
MD5: 381f086cfefa47541d3a8f20d5386c59 SHA-1: 56ef7488c317322d174d182c3a4a8ad52260774c SHA-256: b9a6513ed5183bae6dff64296e38c7c938bd80153f698f04cbaa3cf079545e78
122 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0010

Heuristics 5

  • Image-only PDF lure links through URL shortener high PDF_IMAGE_LURE_SHORTENER_LINK
    PDF is image-heavy with little real text and its clickable action points to a URL shortener. This is a high-confidence credential-phishing carrier shape: the visible page is a screenshot-like prompt while the destination is hidden behind redirect infrastructure.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 99 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinyurl.com/2w7jscw6 In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000001ca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CA 315074 bytes
SHA-256: 247ce851d008abb71a4d42b4099f25ac8eb1c9d97e79bf6fdcf8425045de2281
font_00_sfnt_off00012f73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F73 15676 bytes
SHA-256: d2adfe2ca01cf04608da520dbd71cfe79a7ab0516edf53c0edbe3569d74c05e3
font_01_sfnt_off00014b77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B77 14256 bytes
SHA-256: 61462ae18132282bf4da89c171a5cb86b7d52611d05ca124d6d0d494b0aab197
font_02_sfnt_off000162cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162CD 16864 bytes
SHA-256: b981d99d2c78ff97f4c4a939cace79698c0ffb9b65d0f12c349256fdb8b54bf7
font_03_sfnt_off000184a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x184A4 792 bytes
SHA-256: 56b712e630cfed1b9f4013a6458874cf9350000ffc6e12991770e1f4febddd11

Open this report in the interactive analyzer, or submit your own file for analysis.