Malicious PDF — malware analysis report

Static analysis result for SHA-256 02b396e48e9b1b6c…

MALICIOUS

PDF

86.4 KB Authoring application: PyPDF2
MD5: f5d482af8e846c32ff047f918ebf74dc SHA-1: f5666c542e2e6dcced501342e250eb4ae5356761 SHA-256: 02b396e48e9b1b6c50158284ea5736be86b91e48695f980694c9c63cfe43dfb8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was identified as an image lure, typical of phishing attacks, where a visual element hides a malicious link. The heuristic 'PDF_ESCAPED_URI_IMAGE_LURE' specifically flags a clickable URL within the document, which is reconstructed as http://energy-licey.com.ua/media/media/documents/n5f7jH36Aw.html. This URL is the primary indicator of compromise, likely leading to a further stage of the attack.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • Image-heavy PDF hides clickable URL with PDF string escapes high PDF_ESCAPED_URI_IMAGE_LURE
    PDF is image-heavy with little real text and its clickable HTTP(S) URI is encoded with PDF octal escapes. This combination is common in credential-phishing PDFs that render a screenshot-like prompt and obscure the destination from simple URL extractors.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 86 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://energy-licey.com.ua/media/media/documents/n5f7jH36Aw.html
    • http://www.microsoft.com0
    • http://en.wikipedia.org/wiki/MIT_License
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000e284.bin
8960986e2a00ee134984361cb5b826558e6f34df4563b04ff80403dc20938a01		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE284 152592 bytes
font_00_sfnt_off0000070e.bin
463d8df6c11ec9905c2b5ba2c1585211d28cb313dce8f22ba8f66ed42e879a21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70E 71040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.