CLEAN
8
Risk Score
Malware Insights
MITRE ATT&CK
T1203 Exploitation for Client Execution
T1566.001 Spearphishing Attachment
The PDF file contains heuristics indicating it is related to CVE-2023-26369, a vulnerability often exploited to execute arbitrary code. The presence of external URIs and embedded streams further suggests the file is designed to download and execute a secondary payload. The document body is heavily obfuscated and unreadable, providing no further context on its specific lure.
Machine Learning
- Nyx PDF Classifier clean score 0.0684
Heuristics 4
-
TrueType bitmap font + active content — CVE-2023-26369 related info PDF_CVE_2023_26369_RELATEDPDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
-
External URI info PDF_URIPDF contains an external URL action
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.alcaldiabogota.gov.co/sisjur/normas/Norma1.jsp?i=34054 PDF link annotation
- https://www.minsalud.gov.co/salud/Paginas/Tenencia-In PDF document text
- http://www.dane.gov.co/index.php/esp/estadisticas-sociales/calidad-de-vida-ecv/160-uncategorised/6225-encuesta-In PDF document text
- http://www.noticias24.com/mascotas/noticia/25400/llego-la-hora-de-disfrutar-con-tu-peludito-conoce-estos-parques-en-caracas/In PDF document text
- http://dominemoslatecnologia.org/es/ruta-atencion/ruta-de-acceso-y-In PDF document text
- https://cicloviarecreativa.uniandes.edu.co/espanol/images/anexos/historia_ciclovia.pdfIn PDF document text
- http://www.axacolpatria.co/portal/Portals/0/cicloviasegura/cicloviasegura/SitioEstatico/index.htmlIn PDF document text
- http://www.bogota.gov.co/article/acueducto-de-bogot%C3%A1-hidratar%C3%A1-la-In PDF document text
- http://www.idrd.gov.co/sitio/idrd/?q=node/177In PDF document text
- http://www.inbogota.com/transporte/ciclovia.htmIn PDF document text
- http://www.eluniversal.com.co/salud/las-leches-de-formula-tambien-tienen-sus-problemas-227928-In PDF document text
- http://www.bogota.gov.co/article/temas-de-ciudad/salud/banco-de-leche-materna-tres-anos-salvando-In PDF document text
- http://www.saludcapital.gov.co/Paginas2/Noticia_Portal_Detalle.aspx?IP=270In PDF document text
- https://www.minsalud.gov.co/Paginas/Colombia-contara-con-seis-nuevos-Bancos-de-Leche-Humana-.aspxIn PDF document text
- http://www.sedbogota.edu.co/In PDF document text
- http://www.bogotacomovamos.org/datos/AA_44_evaluacion_educacion.pdfIn PDF document text
- http://repositorio.esepf.pt/bitstream/In PDF document text
- http://www.contraloriabogota.gov.co/intranet/contenido/informes/Estructurales/Subdir%20EstudiosIn PDF document text
- http://www.politecnicojic.edu.co/index.php/historia-del-politecnicoIn PDF document text
- http://www.verbienmagazin.com/javier-de-nicolo-el-apostol-de-los-ninos-de-la-calle-del-libro-su-In PDF document text
- http://bosconia09.blogspot.com.co/2009/03/biografia-de-javier-de-nicolo.htmlIn PDF document text
- http://www.alcaldiabogota.gov.co/sisjur/normas/Norma1.jsp?i=43202In PDF document text
- http://www.alcaldiabogota.gov.co/sisjur/normas/Norma1.jsp?i=44762In PDF document text
- http://www.alcaldiabogota.gov.co/sisjur/normas/Norma1.jsp?i=1507In PDF document text
- http://www.bogocine.com/In PDF document text
- http://www.alcaldiabogota.gov.co/sisjur/normas/Norma1.jsp?i=4125#49In PDF document text
- http://www.bogota.gov.co/article/acueducto-de-bogot%C3%A1-hidratar%C3%A1-la-ciclov%C3%ADa-de-los-bogotanosIn PDF document text
- http://www.eluniversal.com.co/perfiles/viviana-martinez-perezIn PDF document text
- http://www.minsalud.gov.co/In PDF document text
- http://www.bogota.gov.co/article/temas-de-ciudad/salud/banco-de-leche-materna-tres-anos-salvando-ninosIn PDF document text
- http://www.iberblh.org/images/carta_bsb_2010_esp.pdfIn PDF document text
- http://www.sedbogota.edu.co/%20%20imges/stories/destacados/2009/junio/LA%20CALIDAD%20DE%20LA%20EDUCACION%20MAYO%2028%20_3_.pdfIn PDF document text
- http://repositorio.esepf.pt/bitstream/%20handle/10000/153/SeE_13Calidad.pdf?sequence=1In PDF document text
- http://www.sedbogota.edu.co/%20images/stories/destacados/2009/junio/LA%20CALIDAD%20DE%20LA%20EDUCACION%20MAYO%2028%20_3_.pdfIn PDF document text
- http://www.educacioncontracorriente.org/In PDF document text
- http://www.ascolfa.edu.co/In PDF document text
- http://www.idep.edu.co/In PDF document text
- http://www.contraloriabogota.gov.co/intranet/contenido/informes/Estructurales/Subdir%20Estudios%20Econ%C3%B3micos%20y%20Fiscales%20de%20Bogota/2016/Informe%20Estructural%20Educaci%C3%B3n%20Superior%20en%20Bogot%C3%A1.pdfIn PDF document text
- http://www.politecnicojic.edu.co/images/downloads/ley-decreto/ordenanza-41-de-1963-creacion-politecnico.pdfIn PDF document text
- http://www.eltiempo.com/bogota/el-29-de-In PDF document text
- http://www.eltiempo.com/bogota/las-prioridades-de-penalosa-en-sus-primeros-dias-de-gobierno/16471716In PDF document text
- http://www.abc.es/viajar/20140615/abci-hotel-In PDF document text
- http://www.elespectador.com/noticias/bogota/nuevo-parque-mascotas-mosquera-articulo-556754In PDF document text
- http://www.who.int/nutrition/topics/exclusive_breastfeeding/es/In PDF document text
- http://www.who.int/mediacentre/news/releases/2016/breastfeeding/es/In PDF document text
- http://www.eltiempo.com/multimedia/especiales/huella-social-lactancia-y-bancos-de-leche-materna/15932476/1/index.htmlIn PDF document text
- https://www.youtube.com/watch?v=YlHefJk53PsIn PDF document text
- http://www.las2orillas.co/padre-javier-de-nicolo-un-santo-contemporaneo/In PDF document text
- http://www.elespectador.com/noticias/bogota/bogota-perdio-un-defensor-de-los-vulnerados-fallecio-In PDF document text
- http://www.solidaritat.ub.edu/observatori/general/docugral/Convenio182_OIT.pdfIn PDF document text
+13 more URL(s)
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_034_off0003ad98.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3AD98 | 17028 bytes |
SHA-256: 62acf54a6eb611871991b33c80c36dc26d37252079d6d9332046226e72b83e9e |
|||
stream_044_off0003d45a.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3D45A | 65934 bytes |
SHA-256: 192dc48b71182aa8920463f57b4514b68e8e9fa2202dfd3a83968c7246ea5fdf |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
31 of 45 identifiers look randomly generated (e.g. 'FKUcOYeOYeOYeOYeOYeOYeOYeOYfOYfOYfOYfOYf') — consistent with name-mangling obfuscation. Carved artifact contains 305 long base64-like blob(s).
|
|||
stream_175_off00111c83.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x111C83 | 3602016 bytes |
SHA-256: faae44ab764f77a39adf12fb3adf9e9067f74a8822741e60f9d89f665449db02 |
|||
stream_189_off004db24a.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x4DB24A | 405780 bytes |
SHA-256: 721b9b36df459b24e0bf3ae6935560456f9523ac4523c51210d7c01efabdf8f0 |
|||
stream_196_off0058dc0e.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x58DC0E | 600180 bytes |
SHA-256: 286d5853385093fb0ddd94138cffe60603d56f5e70d801c5eb4ab67aade36770 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.