Malicious PDF — malware analysis report

Heuristics 5

• Image-only PDF lure links through URL shortener high PDF_IMAGE_LURE_SHORTENER_LINK
  PDF is image-heavy with little real text and its clickable action points to a URL shortener. This is a high-confidence credential-phishing carrier shape: the visible page is a screenshot-like prompt while the destination is hidden behind redirect infrastructure.
• Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
  PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
• Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
  PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 100 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
• Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
  Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://tinyurl.com/2w7jscw6 In PDF document text

  • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00012f94.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.