PDF malware analysis — malicious · e9c5ba7145d22e02

MALICIOUS

PDF

MD5: 2eb23b0124da950c86eeb0e162ef99f7 SHA-1: 88d030d116f172f6a584de5adf9bd6395447f175 SHA-256: e9c5ba7145d22e02739fa6237b9d8497aa7a1848be9b568a8c5f4e2df890ce80

112 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9256

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 50 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://www.qv.co.ke/Company%20Profile%20and%20Product%20Requirements.7z In PDF document text
- http://www.iec.chIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`icc_00_off00000059.icc`	pdf-icc-profile	PDF ICC profile at offset 0x59	3144 bytes
SHA-256: `2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e`

Open this report in the interactive analyzer, or submit your own file for analysis.