Malicious PDF — malware analysis report

Static analysis result for SHA-256 09f24d38f5ea58a1…

MALICIOUS

PDF

92.7 KB Created: 2023-03-21 18:36:23 +03:00 Authoring application: iTextSharp’ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)
MD5: fa243a28cdcbca70891853bfbbead0c1 SHA-1: 585e2b2245459503aca7bd4c484bd620e1dc59c3 SHA-256: 09f24d38f5ea58a1b5ffe6934973a3faa5ad919977e912e8389c269bf57b8303
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a direct link to an executable payload disguised as a ZIP archive. The heuristic 'PDF_DIRECT_PAYLOAD_LINK' strongly indicates malicious intent. The embedded URL 'http://krishikannada.com/blo/hf98fh92.zip' is the primary indicator of compromise, likely serving as a downloader for a second-stage malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0167

Heuristics 3

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://krishikannada.com/blo/hf98fh92.zip
    • https://www.adobe.com
    • http://www.adobe.com/typeThis

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off000034f2.bin
dc170c6f02f2b156352671fad65a9bda5b1469f65970b14b93d1b21cf765ef1b		 pdf-font-stream PDF embedded font (cff) at offset 0x34F2 2830 bytes
font_01_sfnt_off00004a63.bin
dabca5bdd40353909ac18470e44e9982ebe51b0d3b2f342d78126ed3548b0529		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A63 5360 bytes
font_02_sfnt_off00005cb5.bin
f034645ad92baf4f01365910fa6acf564b8f4da4489ceb3ccaa99230a4139ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CB5 7016 bytes
font_03_sfnt_off00007493.bin
2e140c78ba7a3deff895a12e3ef243ce609aa29c91ae9b82f5f04207a22e0655		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7493 6120 bytes
font_04_sfnt_off0000891b.bin
bcee5ba7d8cfb2e16dcee3a21900987f039f2c0243a316e3a11267d9f4248705		 pdf-font-stream PDF embedded font (sfnt) at offset 0x891B 7272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.