Malicious PDF — malware analysis report

Heuristics 3

• PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
  PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
• Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
  PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://kashuub.com/Bin/support.ClientSetup.msi?e=Access&y=Guest In PDF document text

  • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_00_sfnt_off000092cd.bin)
  • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_00_sfnt_off000092cd.bin)
  • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_00_sfnt_off000092cd.bin)
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_00_sfnt_off000092cd.bin)
  • http://www.microsoft.com/TypographyIn extracted file (font_00_sfnt_off000092cd.bin)

Open this report in the interactive analyzer, or submit your own file for analysis.