Malicious PDF — malware analysis report

Static analysis result for SHA-256 f15265869b006ad5…

MALICIOUS

PDF

359.0 KB Created: 2010-03-16 22:56:45 +08:00 Authoring application: Adobe InDesign CS3 (5.0.4) (via Adobe PDF Library 8.0) First seen: 2026-05-11
MD5: dc4b0c4538f7a400a7d044975da74b33 SHA-1: b410e2d16dcf945400dbe4e7d530379298d263bd SHA-256: f15265869b006ad5bddd46fee4fef71b9908a22dd98df4f026f2866a325f7626
80 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The critical ClamAV heuristic indicates this PDF contains a known exploit (Pdf.Exploit.Agent-19686), suggesting it's designed for client-side exploitation. The presence of an AcroForm button with an action trigger further supports the exploitation vector. While no scripts were extracted, the embedded mailto link and unknown reputation URLs suggest potential command and control or phishing attempts, aligning with a spearphishing attachment delivery method.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 5

  • ClamAV: Pdf.Exploit.Agent-19686 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-19686
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI low PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.linotype.comhttp://www.linotype.com/fontdesignersNOTIFICATION PDF link annotation
    • http://www.linotype.com/licensePraxisPDF link annotation
    • http://www.linotype.com/licenseTradePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#PDF link annotation
    • http://ns.adobe.com/xap/1.0/mm/PDF link annotation
    • http://ns.adobe.com/xap/1.0/PDF link annotation
    • http://ns.adobe.com/xap/1.0/g/img/PDF link annotation
    • http://purl.org/dc/elements/1.1/PDF link annotation
    • http://ns.adobe.com/pdf/1.3/PDF link annotation

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000e8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8E 29952 bytes
SHA-256: edba0438047a1564a5f047c683be494f5aee11c3b035239db9a2e1c612bd8f70
font_01_sfnt_off000471f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x471F1 35105 bytes
SHA-256: 17eeb41b4fe40ff1ca955cba0224970d9dd90cef2331a395f32a3bfecfc3356a
font_02_sfnt_off0004b561.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B561 10997 bytes
SHA-256: bde1fecca0d26371713f2b2e1b79c3537b3694dadf7d7bc1052bebaacc2d905a

Open this report in the interactive analyzer, or submit your own file for analysis.