PDF object hashing shows why document structure beats fragile signatures

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: PDF Object Hashing is a structural fingerprinting approach for malicious PDFs that can cluster related documents even when visible content changes.

Why it matters: It matters because email and malware defenders need detection methods that survive lure changes, encrypted objects, and other PDF mutations that defeat brittle signatures.

Context

PDF threat detection becomes fragile when defenders anchor on surface indicators such as URLs, lure images, or metadata that attackers can swap quickly. The harder problem is preserving detection value when the document still looks legitimate to a viewer but its internal structure reveals a repeatable build pattern. In this case, the security question is not whether a PDF exists, but whether its object layout exposes a reusable malicious template.

That matters for email security, malware prevention, and identity protection because PDFs are often the first stage in credential theft, malicious download chains, or business email compromise. When a file format allows repeated variation without changing the apparent lure, defenders need a structural way to identify related samples rather than a content-only rule set.

Key questions

Q: How should security teams detect malicious PDFs that keep changing content?

A: Security teams should use structural analytics, not just file hashes, URLs, or image similarity. By parsing object types, object order, and stream content, they can cluster PDF variants that share the same build pattern even when lures, branding, or embedded links change. That improves hunting, attribution, and response speed across a campaign.

Q: Why do encrypted PDFs still create detection risk?

A: Encryption can hide embedded content, but it does not remove the document's internal structure. Defenders may lose access to visible URIs or lure text while the object hierarchy, page layout, and annotation relationships still reveal a reusable malicious pattern.

Q: What are the signs that a PDF campaign is part of the same threat cluster?

A: Shared object skeletons, repeated ordering of pages and annotations, and recurring structural patterns are strong indicators that multiple PDFs were built from the same process or builder. Those signals are more useful than a single matching hash when visible content has been updated.

Q: How should email and identity teams respond when PDFs are used for credential phishing?

A: Treat the file as the delivery vehicle and the sign-in flow as the real target. Tighten mail filtering, investigate follow-on web destinations, and coordinate with identity teams when PDFs route users toward credential capture pages or malicious login prompts.

Technical breakdown

Why PDF structure is harder to detect than surface content

PDFs are flexible by design, which is useful for compatibility but difficult for detection engineering. The same visible document can be represented with different whitespace, compressed or plaintext cross-reference tables, embedded or referenced parameters, and stream objects that hide content from casual inspection. Encryption adds another layer because the document structure remains visible while many useful details inside individual objects are obscured. That means a signature built only on URLs, file hashes, or lure text can miss the same campaign when attackers mutate those fields. Structural analysis works by looking at the arrangement of objects instead of the payload text inside them.

Practical implication: Use structure-aware parsing when content-based rules fail against encrypted or repeatedly mutated PDFs.

How PDF object hashing creates a document fingerprint

PDF Object Hashing turns the document into a structural signature by parsing the objects in use, assigning each object a type, and then hashing the ordered sequence of those types. In effect, it creates a skeleton of the file that ignores changing parameters while preserving the build pattern. If two malicious PDFs share a similar object layout, they can cluster together even when the URLs, images, or metadata differ. That is analogous to comparing execution structure rather than a single indicator, which makes the method more resilient for hunting and attribution. The value is not in proving malicious intent alone, but in surfacing likely related samples for deeper analysis.

Practical implication: Treat structural hashes as clustering signals that complement, not replace, existing detection logic.

Why encrypted PDFs can still expose useful detection signals

Encryption does not eliminate the file's internal organization. It hides object contents, but the hierarchy of pages, annotations, images, fonts, and metadata relationships can still be parsed. That matters because many defensive tools stop at what is plainly extractable, which leaves a gap when the document is deliberately wrapped to obscure its lure or embedded URI. Structural hashing shifts the focus to what survives encryption: object presence, object order, and the relationships among those objects. That makes it possible to identify families of PDFs that share the same construction pattern even when the visible lure changes from one campaign to the next.

Practical implication: Prioritise parsers and detections that preserve object relationships, not just readable strings.

Threat narrative

Attacker objective: The attacker wants to use a PDF lure as a durable delivery vehicle for malware, credential theft, or BEC enablement while mutating visible content to evade signatures.

1. Entry occurs when a malicious PDF is delivered through email as a lure document with links, QR codes, or fake invoices.
2. Credential harvesting or malware delivery follows when the recipient opens the PDF and follows the embedded path to a phishing page or payload.
3. Impact comes from the payload stage, where the campaign can install malware, steal credentials, or support business email compromise.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• PyPI secrets exposure 2023: Researchers found 3,938 unique secrets in published PyPI packages, 768 still valid; a new release or yank does not remove them.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Structural fingerprints matter when the attacker controls the lure. Email and malware defenders have spent years tuning rules against URLs, attachments, and visible lure content, but those indicators are easy to mutate. A document's object order, object types, and internal relationships are harder for an attacker to change without altering how the file is built, which makes structure a more stable detection substrate. The practitioner conclusion is straightforward: when surface indicators churn, move the analytic emphasis to file structure and campaign clustering.

PDF Object Hashing is a useful example of detection engineering shifting from indicator chasing to campaign shape analysis. That is a broader pattern in threat hunting: the question is not only what a file contains, but how it is assembled. For email security teams, this is especially relevant where malicious PDFs function as the first hop in malware delivery or credential theft. The practical takeaway is to build detections that survive lure updates, not just the latest sample.

Document structure can also improve attribution confidence. If multiple PDFs share the same skeleton, they may reflect a common builder, workflow, or threat actor even when the payload details differ. That does not replace behavioral confirmation, but it gives analysts a stronger clustering signal than a single hash or URL. Practitioners should use these patterns to narrow investigations and focus response on related campaigns rather than isolated files.

Credential phishing through PDFs is an identity problem as much as a malware problem. When a document leads users to a credential capture page or a malicious sign-in flow, the real target is identity trust, not the file itself. That means email controls, web filtering, and identity protection need to be joined up. The practitioner conclusion is to treat PDF-based lures as an identity ingress path, not just a malware delivery mechanism.

What this signals

PDF-based lures expose a broader detection problem: the file format lets attackers vary content without materially changing the campaign structure. When that happens, defenders need to shift from indicator matching to structural correlation so that one lure update does not create a blind spot across the rest of the cluster.

For security teams, the practical lesson is to treat PDFs as a format problem, not just a malware problem. Internal object relationships, compressed streams, and encryption-aware parsing give analysts more durable pivots for hunting, attribution, and downstream identity-risk triage.

For practitioners

• Harden detection around PDF structure Add parsing and correlation logic that keys on object order, object types, and relationships so mutated PDFs still cluster together.
• Inspect encrypted PDFs beyond visible content Prioritise tooling that can extract and analyse internal objects, streams, and annotations even when the lure text or URI is obscured.
• Correlate PDF lures with downstream identity risk Treat PDFs that lead to credential capture pages, malicious sign-ins, or business email compromise workflows as identity-adjacent threats.
• Use structural hashes as hunting pivots Cluster similar samples by their PDF Object Hash and use those groups to focus analyst time on related campaigns instead of single-file alerts.

Key takeaways

• Malicious PDFs are difficult to defend with brittle signatures because attackers can keep the lure fresh while preserving the underlying campaign structure.
• Structural analysis gives defenders a more durable way to cluster related documents, even when encryption or content changes hide familiar indicators.
• The main operational shift is from single-file matching to campaign-level correlation, which improves both threat hunting and attribution.

Key terms

• PDF Object Hashing: PDF Object Hashing is a method for fingerprinting a PDF by the sequence and type of its internal objects rather than by visible content or file hash. It helps security teams group related documents even when attackers change images, URLs, or formatting to evade detection.
• Stream Object: A compressed object inside a PDF that can contain content a viewer still needs to render or follow. Stream objects matter to defenders because important indicators can be hidden there, which makes simple string-based scanning incomplete.
• Structural Fingerprint: A structural fingerprint is a derived signature based on the anatomy of a file, such as object order, object type, and embedded relationships. In malware analysis, it is useful when content-based indicators are too easy for attackers to alter while the file’s underlying construction remains similar.
• Campaign Clustering: Campaign clustering is the practice of grouping apparently separate samples that share technical characteristics and therefore may belong to the same threat activity. It improves threat hunting by turning many isolated detections into a broader view of attacker tooling, reuse, and infrastructure.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle control. It is designed for practitioners who need to connect identity decisions to broader security operations and governance.