Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff2ca38325ff41ec…

MALICIOUS

PDF

1.50 MB Created: 2025-11-18 11:44:43 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-17
MD5: dd90ddd10c43779798f7afe279ad9536 SHA-1: b9a8f8216f265a2d3c2a8fb9a10de901905fe79f SHA-256: ff2ca38325ff41ec4aff797cbe6ba23155888c42393996f582ee8b4b8be0d288
68 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 5

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • https://wwww.microsoft.com0In extracted file (stream_183_off0010b7b7.bin)
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off00010fc7.bin)
    • http://ocsp.verisign.com0In extracted file (font_02_sfnt_off000e4e47.bin)
    • https://www.google.com.br/maps/search/-29.2093952PDF link annotation
    • https://www.google.com.br/maps/search/-27.6836543In PDF document text
    • https://www.google.com.br/maps/search/-27.7001644In PDF document text
    • https://www.google.com.br/maps/search/-27.7001218In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_183_off0010b7b7.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_183_off0010b7b7.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pkiops/Docs/Repository.htm0In extracted file (stream_183_off0010b7b7.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In extracted file (stream_183_off0010b7b7.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off00010fc7.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_02_sfnt_off000e4e47.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_02_sfnt_off000e4e47.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In extracted file (font_02_sfnt_off000e4e47.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_02_sfnt_off000e4e47.bin)
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (font_08_sfnt_off00118f8e.bin)
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn extracted file (font_08_sfnt_off00118f8e.bin)
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In extracted file (font_08_sfnt_off00118f8e.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 27

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_183_off0010b7b7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10B7B7 113172 bytes
SHA-256: 398d3654f70f77ed25b864bc92be0a8691da39dca2497e3d759ef936914e23e5
stream_189_off0012e09b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12E09B 66336 bytes
SHA-256: 817a2ce0a941750f21d00f5fdf18139fd17c177b8c65786b47c374138a9e685c
font_00_sfnt_off00010fc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FC7 27044 bytes
SHA-256: 3817e084832ece5d67ce55b2641852ff7973230c07bcfaac2c80a80c2bdc6485
font_01_sfnt_off000148f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x148F7 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off000e4e47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4E47 23984 bytes
SHA-256: c65100e12efea2d32a659d0ce23bb39c752d01036dab8318b959fbfa7dab9abf
font_03_sfnt_off000e8459.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8459 92752 bytes
SHA-256: 3cf3f53df25924f8c97051c95a15eefc4e08522a222855b31a06ec6cc249a58d
font_04_sfnt_off000f2e55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E55 56760 bytes
SHA-256: 709bb41c28e9d518376cf15d99b86ef954a898891a29be378866abe9b6ea5205
font_05_sfnt_off000f85d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF85D0 76980 bytes
SHA-256: 2309fb7ffc9ee224e549301f20eb6977243684f4f5a6f8437c72648e5244fb03
font_06_sfnt_off00107f33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F33 52632 bytes
SHA-256: f368f8ce407b08957098acfa106efc4b8a0a3bddb09025037000088a8028ab82
font_08_sfnt_off00118f8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118F8E 98268 bytes
SHA-256: b65c14b655af408baa98c7aa56eca5b73d3be155caf985edb2dab0a9e058893f
font_09_sfnt_off00122744.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122744 86992 bytes
SHA-256: 293db05d3b9a8a671e478e3659d2475b0c991993f2a4c617e80c50fbdf5cd8b7
font_10_sfnt_off0012862d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12862D 83164 bytes
SHA-256: a961f68e2eb115095a55afaef0584b6798c4550624e360f978f5e74864d1186d
font_12_sfnt_off00137312.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137312 41244 bytes
SHA-256: 732a0fcb24b1126110034d815dc0064a177f8f050eee8f2c45dd29f6f1252e52
font_13_sfnt_off0013dc36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13DC36 13776 bytes
SHA-256: e61c0df08316a811fe99f7066a10d71c683651142aff628e5f4e712c9a35213c
font_14_sfnt_off0013fc4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FC4C 25604 bytes
SHA-256: 51bc0a1a54ec298e61083d536da7b2af474284316fdc01a0fd787698583765f7
font_15_sfnt_off00142a47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x142A47 17428 bytes
SHA-256: 00bb4db9a99fb48a4d50ce8e47ace2ba4982cdd59d462c716af4dc86b7909e9f
font_16_sfnt_off001452ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1452CE 3832 bytes
SHA-256: b133c0434493369953b115dd09f3778dc36433829195019809fc3702c06ffd52
font_17_cff_off00146a6b.bin pdf-font-stream PDF embedded font (cff) at offset 0x146A6B 86093 bytes
SHA-256: 427af119e8f704848644710f5da65ea8d385162ce3d78bb774a2b0bda4893f95
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
font_18_cff_off001548db.bin pdf-font-stream PDF embedded font (cff) at offset 0x1548DB 11292 bytes
SHA-256: 0421ea33a9e228bf7533bf061844c4267c15a4cd328bae47155b3a3e8156f710
font_19_cff_off00156ff7.bin pdf-font-stream PDF embedded font (cff) at offset 0x156FF7 9827 bytes
SHA-256: ae63fcc9edee978c8bb1381a6632a9a4d5ed6a9867a504a88e47e0302d940671
font_20_cff_off00158e7a.bin pdf-font-stream PDF embedded font (cff) at offset 0x158E7A 2278 bytes
SHA-256: 3ac479cf8471edf09e5376395ca99ac456381d3b6bf73f83e0367ebe0314b33f
font_21_cff_off0015990b.bin pdf-font-stream PDF embedded font (cff) at offset 0x15990B 266 bytes
SHA-256: 6d199ee99a9063c9fb00a8b64f3902cf25ae0d7324b4cc9e49f575efe9d2ff32
font_22_cff_off0015a302.bin pdf-font-stream PDF embedded font (cff) at offset 0x15A302 333 bytes
SHA-256: 2b28725e49883ea8ebee4959e82f90f813e96592faa3f2d87168b7358c113e45
font_23_sfnt_off0015ac3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15AC3D 37736 bytes
SHA-256: 6552b6922469a1918faaf62dc1eb239140113a79493ade6778f899f0d5fe5375
font_24_cff_off0015d96c.bin pdf-font-stream PDF embedded font (cff) at offset 0x15D96C 9179 bytes
SHA-256: 541730a3616740a142aeaacac89b38848f7474010c491001d4bd993b1ed11053
font_25_cff_off0015fa52.bin pdf-font-stream PDF embedded font (cff) at offset 0x15FA52 11407 bytes
SHA-256: 01ed0b3fb7ad5b67a7255465092b9ca6b7058b3343b837d398f1b5d0f69ed317
font_27_cff_off001767b1.bin pdf-font-stream PDF embedded font (cff) at offset 0x1767B1 1007 bytes
SHA-256: 8190b734ef2a7f28093d05adc8c99d14d1531fa5f8b9ced6f3fd4a9e1ae06789

Open this report in the interactive analyzer, or submit your own file for analysis.