PDF static analysis report

Static analysis result for SHA-256 db22b803bca761cc…

CLEAN

PDF

1.05 MB Created: 2024-12-25 17:16:36 +07:00 Authoring application: iText® 5.5.13.3 ©2000-2022 iText Group NV (AGPL-version); modified using iText® 5.5.13.3 ©2000-2022 iText Group NV (AGPL-version) First seen: 2026-05-27
MD5: f161dd87ba14eaf70bf010bd4f7c7bb5 SHA-1: 93221187ad5d633943339bf602071da969aef69e SHA-256: db22b803bca761ccf1f4ab8c6965a3234c73e4ca49b9c728d4f9f117686ef1b4
2 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains heuristics indicating a generic JavaScript exploit stage recovery. Two JavaScript files were extracted, which appear to be malformed or truncated PDF content rather than executable scripts. The primary heuristic suggests the PDF is designed to recover and execute an exploit stage, likely through embedded JavaScript, though the extracted scripts themselves do not contain clear malicious commands. The benign URLs suggest no direct C2 communication is immediately apparent from this stage.

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/tspca.crt0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0001ef2e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1EF2E 834240 bytes
SHA-256: d9fb32eb1646d6fc977c63fd780a46c60b6d1f607bf55eb7baa185aa2637711d
font_00_sfnt_off00001af8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF8 32672 bytes
SHA-256: 4f7dc5cad7974416e0eec0afd92fa8839e69e96fd3dfa077f9a961470805731a
font_01_sfnt_off000077c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x77C9 32264 bytes
SHA-256: 45b3b2f0935a302ca7b486c927feec5891e30cad7643109e63ed3ba556cbc1e4
font_02_sfnt_off0000d4ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4AE 40056 bytes
SHA-256: bf9ae4701ca47be483a0f7efcaa174a77b1252529a01ff9f8f8f4a0a01eccbda

Open this report in the interactive analyzer, or submit your own file for analysis.