PDF static analysis report

Static analysis result for SHA-256 1acd27d95c81ac58…

CLEAN

PDF

5.9 KB Created: 2015-06-03 06:01:16 Authoring application: HTML2FPDF >> http://html2fpdf.sf.net (via FPDF 1.52) First seen: 2015-08-19
MD5: d3483068152e6ab841b66a6014a68af1 SHA-1: d9e824559b24e38b9c472fd7f912cf49a038439b SHA-256: 1acd27d95c81ac58220511dfb2560bedbb93cd161d6daf458a1ba2d94d660494
12 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains embedded JavaScript and multiple external URIs pointing to domains that appear to be hosting malicious content, disguised as pharmaceutical information. The document body's text, though truncated, also contains references to pharmaceutical products and URLs, reinforcing the lure. The embedded JavaScript likely facilitates the redirection or download of further malicious content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0093

Heuristics 3

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/cialis-samples.pdf PDF link annotation
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/viagra-pros-and-cons.pdfIn PDF document text
    • http://www.osirisconsulting.com/Scripts/img/o.php/viagra-better-than-cialis/In PDF document text
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/viagra-japan.pdfIn PDF document text
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/viagra-while-drinking.pdfIn PDF document text
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/natural-sildenafil.pdfIn PDF document text
    • http://html2fpdf.sf.net)/CreationDateIn PDF document text
    • http://html2fpdf.sf.netIn PDF document text
🗂 Part of campaign: sf.net 56 samples