PDF static analysis report

Static analysis result for SHA-256 2f7aed7e396a2727…

SUSPICIOUS

PDF

110.0 KB First seen: 2023-12-08
MD5: 41d3a76600c9872239cb9a8e67d5be19 SHA-1: af18453e7100c7129d95cd8a9bcdec06db8fd4ba SHA-256: 2f7aed7e396a272785a1f017ff6638de6adce6b31316be023b617668fde612dc
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 3

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sirenassociates.com/procurement_manual.pdf PDF link annotation
    • http://www.monotype.comMonotypeIn extracted file (font_01_sfnt_off00007336.bin)
    • http://www.monotypeimaging.com/http://www.monotypeimaging.com/ProductsServices/TypeDesignerShowcaseNOTIFICATIONIn extracted file (font_04_sfnt_off0001321c.bin)
    • http://www.monotypeimaging.com/html/license.aspxIn extracted file (font_04_sfnt_off0001321c.bin)
    • http://www.cyberessentials.ncsc.gov.uk/getting-certified/In PDF document text
    • https://www.unglobalcompact.org/what-is-gc/participants/132132-Siren-AssociatesIn PDF document text
    • http://www.fonts.com/web-fontshttp://www.fonts.com/info/legal/eula/web-fontsIn extracted file (stream_008_off0000e51c.bin)
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn extracted file (font_01_sfnt_off00007336.bin)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0000e51c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE51C 35220 bytes
SHA-256: b568d7b65dcf41aefcdf1054ca536072de0f54407316e4649b5643a6d43da1b9
font_00_sfnt_off000046ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46AB 17856 bytes
SHA-256: 10b995254a4e6c7eaa309c85cd6d24529b4716721fc4e6847c56bcbbd4b3dfbd
font_01_sfnt_off00007336.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7336 30900 bytes
SHA-256: a39badcabf3a2ae224d6d32d1b52dd9f3e3ab23ae235ded4ff07580208946468
font_02_sfnt_off0000a674.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA674 29220 bytes
SHA-256: 560231e3f06de2d1603286279effdf1e2533273bd72edcbbe048bad345ee5710
font_04_sfnt_off0001321c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1321C 17004 bytes
SHA-256: 99e6ae25028fd8536b46c7e3d35ffa9afcade1f519536f495930ce4863d3ff28
font_05_sfnt_off00014cc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14CC6 16780 bytes
SHA-256: 7e974e49a975874d8722d969220a9ea10cedaa1dd14f43f995d6868ca8134c06

Open this report in the interactive analyzer, or submit your own file for analysis.