PDF static analysis report

Static analysis result for SHA-256 24ff131bbb984be2…

SUSPICIOUS

PDF

130.6 KB Created: 2015-11-17 03:08:21 -05:00 Authoring application: RAD PDF (via RAD PDF 3.2.1.0 - http://www.radpdf.com) First seen: 2021-09-27
MD5: adf0e73a42b7fd3e3c458f0e0379e1fb SHA-1: 0d6bcae2c620a6fa1cf438918c85111da7863884 SHA-256: 24ff131bbb984be2f10166cbd064a75ddcad939f47bcb4c86e15cefd85708ba8
26 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains multiple embedded URLs, including shortened ones like 'https://tr.im/Lek7d' and 'http://tinyurl.com/jfjozmm', which are indicative of phishing or malware distribution attempts. The presence of PDF_URI and EMBEDDED_URL heuristics further supports this. The document body itself is composed of these URLs, suggesting the primary function is to redirect the user to external content. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier clean score 0.1138

Heuristics 4

  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tr.im/Lek7d PDF link annotation
    • http://www.serims.com/News/Site.phpIn PDF document text
    • https://ketman.ml/pdf/payment.htmlIn PDF document text
    • https://foodmanna.net/image/Jpg/png/payment.htmlIn PDF document text
    • http://www.radpdf.comIn PDF document text
    • https://lifedoubledoc-sharepr0m.hostingerapp.com/pfr/yt4/In PDF document text
    • https://colegiovirtualquiche.com/Office/Microsoft/#In PDF document text
    • https://lifedoubledoc-sharepr0m.hostingerapp.com/9lop/homeyatchIn PDF document text
    • https://everlynganza-drlvedodoc.hostingerapp.com/a1/br04/In PDF document text
    • https://huntingcalbany-probtvild.hostingerapp.com/t5/b6tIn PDF document text
    • https://huntingcalbany-probtvild.hostingerapp.com/8pr/pr9v/In PDF document text
    • https://rolzprios-quarletpax.hostingerapp.com/reco/2sldIn PDF document text
    • https://my-sharepad-online.hostingerapp.com/vv/onle/index.phpIn PDF document text
    • http://www.radpdf.com)/Creator(RADIn PDF document text
    • http://www.dynaforms.comIn PDF document text
    • http://www.radpdf.com)/RadPdfCustomData(pdfescape.com-open-2CE32DA255781FE365681C566CACEA040A6F057847ADF21FIn PDF document text
    • http://tinyurl.com/jfjozmmIn PDF document text
    • http://tinyurl.com/jrxuq5xIn PDF document text
    • http://tinyurl.com/jj4afv9In PDF document text
    • http://tinyurl.com/j7y925wIn PDF document text
    • http://tinyurl.com/z3rfmrrIn PDF document text
    • http://www.facebook.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004465.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4465 73728 bytes
SHA-256: d43e7b69e1e25fe070d522da94c4396003aae12eb7a75aecb2cc0f5e5feef6a6

Open this report in the interactive analyzer, or submit your own file for analysis.