Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce099d4975c979ad…

MALICIOUS

PDF

98.0 KB Created: 2026-06-04 20:09:43 +00:00 Authoring application: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36 (via Skia/PDF m143) First seen: 2026-06-05
MD5: 77a83ca278a453ad5436e58daa4c4dce SHA-1: 11d66d3d3344abe6c06f8f166c3be6e3697a8770 SHA-256: ce099d4975c979ad6d5ecf65e1df9eb7565952e9ea9f81d8833b4cf9586bad44
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
    PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00000196.icc pdf-icc-profile PDF ICC profile at offset 0x196 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00007129.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7129 53480 bytes
SHA-256: 6f75b5dd238b025d8a71051579b14362713c119e3b4a7e3050993fdaa386329f
font_01_sfnt_off0000ff1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF1E 33264 bytes
SHA-256: deb061c0d40cbe9d567f4484877b2ff728dec3298ccdeca6617d5fea784c2a0a
font_02_sfnt_off000157b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x157B5 17012 bytes
SHA-256: 74d544edcf2ba2606680c355d0a5c8c2781ec37c0e686e5415350d7931249fc5

Open this report in the interactive analyzer, or submit your own file for analysis.