Malicious PDF — malware analysis report

Heuristics 4

• TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
  PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
• Unusually high stream count medium PDF_MANY_STREAMS
  PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.mrcet.ac.in/

  • http://www.tantel.ca/Lathe..html&h=600&w=800&sz=152&hl=en&start=7&usg=__pyDvMQe0ACg4h7GOKBKndRZkgLg=&tbnid=X0Cv663g0m2OJM:&tbnh=107&tbnw=143&prev=/images?q=lathe&gbv=2&hl=en
  • https://www.electronicshub.org/temperature-controlled-system/
  • https://www.electronicshub.org/reverse-parking-sensor-circuit/
  • https://www.electronicshub.org/street-light-that-glows-on-detecting-vehicle-movement-using-ir-sensor/
  • https://www.electronicshub.org/portable-ultrasonic-range-meter/
  • http://www.fourslide.com/images/products/smallparts.jpg
  • http://158.132.205.160/Digital_Factory/arts/pix/DF_layout.gif
  • http://www.piaggioaero.com/immagini/pagine/Sito%20Flash/Products/focus_point_assemblyline.jpg
  • http://halmapr.com/news/elfab/files/2007/11/inspection-cropped.jpg
  • http://www.hghouston.com/images/testing.jpg
  • http://www.fileguru.com/images/b/automatically_schedule_your_employees_to_3_shifts_business_scheduling-9055.jpeg
  • http://www.manaresults.co.in/
  • http://ocsp.verisign.com0
  • http://images.google.ie/imgres?imgurl=http://powerpressindia.com/images/250k1.jpg&imgrefurl=http://powerpressindia.com/&h=381&w=335&sz=44&hl=en&start=21&usg=__ZT0dLkOASKOu6WlC3fV9G4Zc1zs=&tbnid=UcF25LD6t9YhCM:&tbnh=123&tbnw=108&prev=/images?q=power+press&start=18&gbv=2&ndsp=18&hl=en&sa=N
  • http://images.google.ie/imgres?imgurl=http://www.tantel.ca/Images/Lathe/Lathe
  • http://product-image.tradeindia.com/00174221/b/Nickle-Plating-Plant.jpg
  • http://images.google.ie/imgres?imgurl=http://www.atlasservices.us/sitebuildercontent/sitebuilderpictures/welding.jpg&imgrefurl=http://www.atlasservices.us/id10.html&h=600&w=803&sz=34&hl=en&start=2&usg=__f3T5DhyDZFz0QmIWI0G-Ri6oMuo=&tbnid=p3J0cqEOCUV6SM:&tbnh=107&tbnw=143&prev=/images?q=welding&gbv=2&hl=en
  • http://images.google.ie/imgres?imgurl=http://www.conveyco.co.za/images/Home_Page/FP003.JPG&imgrefurl=http://www.conveyco.co.za/&h=434&w=540&sz=233&hl=en&start=18&usg=__2RAj_61MWnXJGYF1FkbEtjYiKd0=&tbnid=Uq1A6s-HCwPXwM:&tbnh=106&tbnw=132&prev=/images?q=conveyors&gbv=2&hl=en
  • https://en.wikipedia.org/wiki/Strategic_management
  • https://en.wikipedia.org/wiki/Workflow
  • https://en.wikipedia.org/wiki/Business_process
  • https://en.wikipedia.org/wiki/Organization
  • https://en.wikipedia.org/wiki/Customer_service
  • https://en.wikipedia.org/wiki/Operational_costs
  • https://en.wikipedia.org/wiki/Competitor
  • https://en.wikipedia.org/wiki/Holism
  • https://en.wikipedia.org/wiki/Electric_current
  • https://en.wikipedia.org/wiki/Hydraulic_fluid
  • https://en.wikipedia.org/wiki/Pneumatic
  • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoft
  • http://en.wikipedia.org/wiki/MIT_License
  • http://www.microsoft.com/typography/fonts/default.aspx
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0@
  • http://www.microsoft.com/Typography/0
  • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYou
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
  • http://www.microsoft.com/typography
  • http://www.microsoft.com/typography/fonts/
  • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H
  • http://www.microsoft.com/pki/certs/CSPCA.crt0

  +17 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.