Malicious PDF — malware analysis report

Static analysis result for SHA-256 232b2a0e057912ca…

MALICIOUS

PDF

97.7 KB First seen: 2021-01-23
MD5: 9b0706a95573a6b0b2562ded4e0edd21 SHA-1: 965fe5cfbea59859c6f5d9b4a7f1c69669044b1d SHA-256: 232b2a0e057912ca58ad38ff7ba9979548426109d9140a4dd37922d0e0ad7c23
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0089

Heuristics 4

  • Image-only PDF lure links through URL shortener high PDF_IMAGE_LURE_SHORTENER_LINK
    PDF is image-heavy with little real text and its clickable action points to a URL shortener. This is a high-confidence credential-phishing carrier shape: the visible page is a screenshot-like prompt while the destination is hidden behind redirect infrastructure.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 1 text block(s), carries a click-outward action, and is only 97 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://igeeks.co.uk/lag/index.html PDF link annotation
    • https://bit.ly/2JnR6IIIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off00013816.bin pdf-font-stream PDF embedded font (cff) at offset 0x13816 258 bytes
SHA-256: fdccc47d292870921353d7904775c82177cfc582ee5159ec62e5767f287020a7
font_01_sfnt_off00013926.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13926 18480 bytes
SHA-256: 3582b8d093d5b919682b4425793be6f65e38383bbd5f80814b13f2db8daf1813

Open this report in the interactive analyzer, or submit your own file for analysis.