PDF static analysis report

Static analysis result for SHA-256 3944f401ec495d69…

SUSPICIOUS

PDF

249.8 KB Created: 2018-03-31 16:30:43 UTC Authoring application: RAD PDF (via RAD PDF 3.4.2.0 - http://www.radpdf.com) First seen: 2019-05-16
MD5: 819c4c873298245b3322d52c9f45a996 SHA-1: e8e8893a54a2a097d2a6a5c0dcd5f03ccf759b10 SHA-256: 3944f401ec495d6941e6f2e76ee6813fb6c784f8d725505b8d7ad7d8e9563dc3
32 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded and clickable URLs, with one heuristic specifically flagging a URL shortener. The presence of a 'download button' lure further suggests an attempt to trick the user into navigating to a malicious site. The primary external URI identified is https://qwfle.com/benz/doc/iii.html, which is likely the intended destination for the user after potentially navigating through the URL shortener.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 4

  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://qwfle.com/benz/doc/iii.html PDF link annotation
    • https://milkfoodkota.com/csd/360/In PDF document text
    • https://livestreamhd-tv.com/wp/css/one-2/In PDF document text
    • http://www.radpdf.comIn PDF document text
    • http://www.radpdf.com)/Creator(RADIn PDF document text
    • http://www.dynaforms.comIn PDF document text
    • https://bit.ly/2rrtc6SIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000400f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x400F 20368 bytes
SHA-256: a2443bc500dd6bf06d1cae1511bb309be0e1a7159494027214e9e033bf6b4332
icc_00_off000025a8.icc pdf-icc-profile PDF ICC profile at offset 0x25A8 4456 bytes
SHA-256: ee2f821d16d12ec9e9f2958ac8865f40912d0ce1fb9625a31b594fab942b1caf
icc_01_off0000333d.icc pdf-icc-profile PDF ICC profile at offset 0x333D 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_01_sfnt_off00006eaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EAA 8260 bytes
SHA-256: 4924c730125fbbd18aa3d14d71ea629c9d6eaf47423e0337cff87fd407018da5
font_02_sfnt_off000083fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83FC 16888 bytes
SHA-256: 66e5d8ffaefe7f4fe65caed31caca72cf9edc2761e422d72362d9f1a66853bf5

Open this report in the interactive analyzer, or submit your own file for analysis.