PDF static analysis report

Static analysis result for SHA-256 274629f30d216afb…

SUSPICIOUS

PDF

17.16 MB First seen: 2020-08-10
MD5: f3e40b0aa9ac8858ef60d0b60cb74c1f SHA-1: f0fdfd0df77c5e60c9e9c2bd38db527ae85f9567 SHA-256: 274629f30d216afbf51d1f3ce365b410c1853472964e38337986598c8a4ec4c9
26 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF file exhibits characteristics associated with exploit delivery, specifically a high stream count suggesting obfuscation and a heuristic indicating a relation to CVE-2023-26369. The presence of an external URI, while not directly malicious in this context, is often used in exploit chains. No scripts were extracted, limiting the ability to determine the exact payload or further actions.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3080

Heuristics 4

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mrcet.ac.in/ PDF link annotation
    • http://www.mrcet.ac.in/)/TypeIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn PDF document text
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In PDF document text
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In PDF document text
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In PDF document text
    • http://www.microsoft.com/TypographyIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoftIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
    • http://www.microsoft.com/Typography/0In PDF document text
    • http://www.microsoft.com/typography/fonts/In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/tspca.crt0In PDF document text
    • http://www.microsoft.com/truetype/fonts/wingdings/YouIn PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn PDF document text
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In PDF document text
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn PDF document text
    • http://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.microsoft.com/typography/0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off000153ff.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x153FF 183016 bytes
SHA-256: ad23422b00f3a12bd6633cf0c3799bfbd8cc1d1c044377fbbb6ab8c432574e3f
stream_007_off000332c9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x332C9 61428 bytes
SHA-256: 9973c305562f8676e2346f3ad50c5e57364b2492c5358994e98581db683e59a3
stream_012_off0004611b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4611B 59444 bytes
SHA-256: e04c0e73578f374b28cb28c449f3d94716920489277f6c141abadda5f102e0b2
stream_018_off000598bf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x598BF 353532 bytes
SHA-256: 49ecb630cef294822319ba182d27176b1e2106b6285d8a6677f7417def22e630
stream_019_off0007f694.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7F694 353584 bytes
SHA-256: 4963371844c5f1a6f9f1b6bbad963115ad3f13454ab226088e68e04c62ec5117
stream_031_off000c6dbd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC6DBD 53172 bytes
SHA-256: b57dcad91a1711d5724f0c5bbd46ed141fabfdfdd2fea56a0f2d22ae6e2126f5
stream_057_off00185ac5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x185AC5 333004 bytes
SHA-256: c29ffe71a391a329d0f3ed2412f8deeed1bc0a02f541ad3cbe9a761e0ebf9271
stream_064_off001cd775.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CD775 338952 bytes
SHA-256: 3cf81e40242ac2e9ea4b88a79397807c51729f4ee3f2c8f1471fbed0233a53bf
stream_071_off001fd2fa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1FD2FA 403768 bytes
SHA-256: 61df4daec332ee4614b15c8baf476187daa2607563529adf3643936a730627cb
stream_072_off00229420.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x229420 367060 bytes
SHA-256: 92ef76a7469c878904e66f8e8be1cfe563922cfaa1752bd6fa6586a18180cfbd
stream_110_off002fd5f7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2FD5F7 334404 bytes
SHA-256: 9ece0b19163e5a1d771e5a63b52dbe88f475b01d0c1ad04a0f95b54e2e77f141
stream_124_off00339536.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x339536 335912 bytes
SHA-256: 75dbade27236bf2bc83298b88b3f4866f0c166f69093f56b1670c0869a4c224c
stream_128_off00381e7b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x381E7B 321856 bytes
SHA-256: e80a4ea06a80225b65ac6c4fe440397d227f5dfdafcf6808c8bf1967ffb3a048
font_01_sfnt_off0003956c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3956C 48056 bytes
SHA-256: 821feffec538842c1687626d30a5c8e4caaa4a6df9f70b4c840e6f1c4c043a84
font_02_sfnt_off0003e062.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E062 18624 bytes
SHA-256: 44ecd060b9b203aedfa42a59df7e0bad8b4320f585e05b4ea58de62e055a790c
font_03_sfnt_off0004be44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4BE44 49232 bytes
SHA-256: 136672707e5ef7d13dca8995080221a36d6f677bba1b89e5fd94c06dc514a8aa
font_04_sfnt_off00050b58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50B58 20892 bytes
SHA-256: ab3a1f3deb0e4e23cde8b6d6034100aed9b74a753194cf1284bd522a80e46a03
font_06_sfnt_off000a55bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA55BB 72080 bytes
SHA-256: 3aae85620a8da084c0d88daba6009b9bb6f131be5c946a99a89638f98d8eda85
font_07_sfnt_off000af22b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF22B 90268 bytes
SHA-256: a98b99f4c5350cb2807a177c92bf5c3bdb3ef1e826c15d7bae1321e5fe1926d0
font_08_sfnt_off000ba9df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA9DF 28148 bytes
SHA-256: 2428df7e6a90edacd13c8fa289741db4114ab71d9b49ef4366576a244d44c684
font_10_sfnt_off000cc2bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC2BF 21904 bytes
SHA-256: aeb2daf805a684fbffc0c4fc4bb80b611849c3a613cc0b2d6405f6871aea1bc1
font_11_sfnt_off000cf31a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF31A 30776 bytes
SHA-256: e70dcc7d532c5440b752c8c0852c9573731277b550e8df18a41e9c74c84ee68f
font_12_sfnt_off00100cfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100CFC 170312 bytes
SHA-256: d9dd239fef52a2f613c68ccce1655ceaf79d8389d46f8ae343c0194705bbcbc7
font_13_sfnt_off0011473e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11473E 48984 bytes
SHA-256: cfa51b0084df9246c62451049f83186d8a15511add5e919fdbfcd0f2e7134335
font_14_sfnt_off0012f0fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F0FD 23148 bytes
SHA-256: 0b3442a5dcced2030300296a2148b0268e2c3b7f9da43b270d9146a79b0cbfd3
font_15_sfnt_off001324cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1324CC 202028 bytes
SHA-256: 4f7cc55bfae9c5ebdbf518bedcb7d079769ba0ffe8130654133e778fb9230a02
font_16_sfnt_off001415e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1415E1 169796 bytes
SHA-256: 6950f9f3d2d7cb4fd75c9e0a909d9e4e86f8ffcbc9f7589995c9dcbbae4e637d
font_17_sfnt_off00156559.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x156559 59968 bytes
SHA-256: ac6a19f559e47f3b4453ade3aa532f238009ebf6239367a45b866b0dfd984436
font_18_sfnt_off0015d2e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15D2E3 54208 bytes
SHA-256: 90691d67193d9b888f48c2704802c3e8415359e4c3926911dfac0b5538ca60a6
font_19_sfnt_off00163bc0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x163BC0 329128 bytes
SHA-256: 3919491c16b6921682e0e7c056c55189829f97da5c68f90c415a2a464cb19c21
font_27_sfnt_off0045df1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45DF1C 343956 bytes
SHA-256: ed030a76492ad0759f9041a9f14577e13eb5142be38ea85dac846569a357edd4
font_29_sfnt_off004ba55c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4BA55C 365528 bytes
SHA-256: 857fb7fadbffe42e3db6250cb782662f3367d01ef2de3afcea7b44ca3ddcca1a

Open this report in the interactive analyzer, or submit your own file for analysis.