Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4050714b2abb49d…

MALICIOUS

PDF

1.07 MB First seen: 2026-06-11
MD5: f36e8867080d69faaa41a3757ee1d502 SHA-1: f9f4a45b2e22983066a149200f6be712da43bd89 SHA-256: d4050714b2abb49d0e577ed93240cbf0e17446ce5ad21a08953f2e5dd7cddf71
82 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 3

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • PDF paints image(s) but contains no text operators medium PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.dropbox.com/scl/fi/j2i47lak4ahvryjwczrad/action1_agent-Adobe_Install_pt-br.msi?rlkey=w2c52z1fst5bdk1oryb8174uu&st=2avtvdz6&dl=1 In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.