PDF static analysis report

Static analysis result for SHA-256 31c5af8088a67881…

CLEAN

PDF

362.7 KB Created: 2021-05-26 09:20:49 +09:00 Authoring application: Microsoft® Word 2016 First seen: 2021-11-20
MD5: 08f543defb704ecd5118bc789baf14bb SHA-1: bc78753b95a8c957da5713679f00c7dd88e60263 SHA-256: 31c5af8088a67881c246e7219fe6b55727f4489af0c5f26896049ab597b7a2c1
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0216

Heuristics 2

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://en.wikipedia.org/wiki/MIT_License In extracted file (font_02_sfnt_off000392d1.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_02_sfnt_off000392d1.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_02_sfnt_off000392d1.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_02_sfnt_off000392d1.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_02_sfnt_off000392d1.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000063a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63A1 294136 bytes
SHA-256: 0efe4949c1a2dc5eed3cb6ec467b5f0f2ad4dce0daf481642f56e2e983e7076c
font_01_sfnt_off000124bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124BC 1090584 bytes
SHA-256: 5d91bd4daa69b2a43eb136db1e305f1183b5602eeb9c05d910f6d05743c20762
font_02_sfnt_off000392d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x392D1 381692 bytes
SHA-256: c2322f549700b94a169426d9e648950279cbd0f74497bb8567be957b0159f527
font_03_sfnt_off0004fd31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4FD31 268020 bytes
SHA-256: 7a4dfbfb90c3f5e02fb27a774a5a6b92105de7468918da1945d6c1ea531a6701
font_04_sfnt_off0005503a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5503A 818212 bytes
SHA-256: 28b104284318557256459d2489ac9270dde01f8f20392385c686a007d8e74ed8

Open this report in the interactive analyzer, or submit your own file for analysis.