Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba4efe0b700ced59…

MALICIOUS

PDF

97.9 KB Created: 2026-06-04 20:17:57 +00:00 Authoring application: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36 (via Skia/PDF m143) First seen: 2026-06-05
MD5: 7891a3a4f5404c51ecdec4ed72d4e377 SHA-1: a851951824e6f085db2c1394d600fed63b5edfd4 SHA-256: ba4efe0b700ced5923d840ee93a0e43c5ec36e8c84bf85b35ab16cc4b1167f2d
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
    PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00000196.icc pdf-icc-profile PDF ICC profile at offset 0x196 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off0000712a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x712A 53316 bytes
SHA-256: 1459c30b5e76dd6c7f3d7527b4f0c9b5393c18fcb35ccf79bee19146e226f1a4
font_01_sfnt_off0000fe90.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE90 33264 bytes
SHA-256: deb061c0d40cbe9d567f4484877b2ff728dec3298ccdeca6617d5fea784c2a0a
font_02_sfnt_off00015727.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15727 17012 bytes
SHA-256: 74d544edcf2ba2606680c355d0a5c8c2781ec37c0e686e5415350d7931249fc5

Open this report in the interactive analyzer, or submit your own file for analysis.