PDF static analysis report

Static analysis result for SHA-256 0ca91fe1b9e5b165…

SUSPICIOUS

PDF

121.1 KB Created: 2018-11-05 09:43:06 -06:00 Authoring application: Nitro Pro 11 (11.0.8.469) First seen: 2021-05-26
MD5: b25066b5e8db8a9c83a61656e083a24e SHA-1: 0fb665ad846351c1ae4f055b5729e0e4f44057bb SHA-256: 0ca91fe1b9e5b1650f6c2f2cb769ed52407a52a11b7eba5e06ca60ec59dc0dfb
56 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-based lure, typical of phishing attacks, presenting a fake Apple iCloud receipt. The document body contains multiple suspicious URLs that are likely used to redirect the user to a malicious site for credential harvesting or malware delivery. The ML classifier also flagged this PDF as malicious, increasing confidence in its malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9739

Heuristics 4

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 121 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://auth-cloudservices-07.usa.cc PDF link annotation
    • http://auth-cloudservices-08.usa.ccIn PDF document text
    • http://auth-cloudservices-09.usa.ccIn PDF document text
    • http://auth-cloudservices-10.usa.ccIn PDF document text
    • http://auth-cloudservices-11.usa.ccIn PDF document text
    • http://auth-cloudservices-12.usa.ccIn PDF document text
    • http://auth-cloudservices-13.usa.ccIn PDF document text
    • http://auth-cloudservices-14.usa.ccIn PDF document text
    • http://auth-cloudservices-15.usa.ccIn PDF document text
    • http://auth-cloudservices-16.usa.ccIn PDF document text
    • http://auth-cloudservices-17.usa.ccIn PDF document text
    • http://auth-cloudservices-07.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-08.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-09.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-10.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-11.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-12.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-13.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-14.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-15.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-16.usa.cc)/TypeIn PDF document text
    • http://auth-cloudservices-17.usa.cc)/TypeIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a849.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA849 32744 bytes
SHA-256: 336ec4369b047d2b995acf5191f051bbb93c9ad88205397ab722b2edc2c778e8
font_01_sfnt_off0000ede3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDE3 7048 bytes
SHA-256: d691ed17422910b4cdb67d88f29ec324ad627d816efe8b9e4e95b934b7e6ae7e
font_02_sfnt_off0000fce6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCE6 36568 bytes
SHA-256: dc2611a231f90b59db43121299231a03f6bc38e89c995709c65a03ff66fa6ce6
font_03_sfnt_off00014c6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C6D 23264 bytes
SHA-256: 0589c3f4a3ad59e63e9e535c6df63cceb0ed1d2599034f355aca63c8c2351c14

Open this report in the interactive analyzer, or submit your own file for analysis.