PDF static analysis report

Static analysis result for SHA-256 53cf50c3d4b387cb…

CLEAN

PDF

20.47 MB First seen: 2014-11-01
MD5: 3f55d172514e2b28dbd2c0d48ee6a87f SHA-1: 851a14b65d24958c8642517b517fb3305c92174a SHA-256: 53cf50c3d4b387cbb922556f9fd0bc57d9c14cb4afcd1bc40e848513c81b773f
22 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file exhibits characteristics of malicious intent, including embedded JavaScript and an unusually high number of streams, which can be used for obfuscation or exploit delivery. The presence of embedded JavaScript (PDF_JS heuristic) indicates an attempt to execute code within the document. The high stream count (PDF_MANY_STREAMS) further suggests complex or obfuscated content, often employed to hide malicious payloads. Without a document body or script content, the exact attack vector is unclear, but the technical indicators point towards a potential exploit or downloader.

Machine Learning

  • Nyx PDF Classifier clean score 0.2091

Heuristics 2

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://youtu.be/GI2Prj4CGZI In PDF document text
    • http://youtu.be/iesoHVfIg6IIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_025_off00b9fccd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB9FCCD 10888 bytes
SHA-256: 6b55855145325fe09b55522cf96fde9215da5de12c3d11d0ff01738f179d5581
icc_00_off0000028e.icc pdf-icc-profile PDF ICC profile at offset 0x28E 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
icc_01_off0001f88d.icc pdf-icc-profile PDF ICC profile at offset 0x1F88D 1328 bytes
SHA-256: eda03c8910c87b8a3e3c1ffbc35d223da8ae1d0dcfbad0c153c4eefbff436723
font_00_sfnt_off00b99259.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB99259 2284 bytes
SHA-256: 09e6d13fd6a3d393c1ed8ac11b23cdac650191d31b08d070f535ae3a18bc2a2c
font_01_sfnt_off00b99b5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB99B5F 1636 bytes
SHA-256: e6dc75f4c0bbe08495780f708b3d6890d952f829586f8806e28a2e007ccfb1d0
font_02_sfnt_off00b9a354.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9A354 7408 bytes
SHA-256: 887b118e7d238070870a931d0a1ff5923d048cc712c1e5ab512dd80bb9317845
font_03_sfnt_off00b9ba3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9BA3C 1984 bytes
SHA-256: 709595767e2545d2eaf225ee384b260ad9d3d36ff237f890dfdcd85e09f83892
font_04_sfnt_off00b9c23a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9C23A 10620 bytes
SHA-256: 33b0800f49a6b24248437204dedb4d99cc0313f4f641d854e812134a50ff737b
font_05_sfnt_off00b9e1ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9E1AC 9044 bytes
SHA-256: 29f10867dbf035e3a6d506152cff1b276aabf0f990e702538284767098499381
font_07_sfnt_off00ba1d9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA1D9F 7880 bytes
SHA-256: cda7cb9bdfbbb1857631fa42ad02ada3ecdf7641eeb4a4a702071dbc6c2c680e
font_08_sfnt_off00ba361a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA361A 7476 bytes
SHA-256: 875a6daea039b7134ff14241fafc008086afd833d7954b18c3c7746f8d7b450f
font_09_sfnt_off00ba4d60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA4D60 8508 bytes
SHA-256: 954a3343f93dd3dc28e39900d20b3ce04628dc2f91c60b6d7d8c6b85b15c8f98
font_10_sfnt_off00ba67fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA67FE 1448 bytes
SHA-256: cac656a60be01d32935ade51f1a5ea3edbffe085fcbabf8233df1314e5bd1708
font_11_sfnt_off00ba6e07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA6E07 11024 bytes
SHA-256: c40fc1ad5cade511aadf71614e2c4021a0e1a28279b9c0589b2807317e08f6c0
font_12_sfnt_off00ba8ffb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA8FFB 7588 bytes
SHA-256: 9c6fd83c7a4d58ff765e1549daa41838522450d42b78606656a547ebd23f3eb6
font_13_sfnt_off00baa7c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAA7C4 8528 bytes
SHA-256: 7600f397493f6f340c2a6271c678f6a89d26a613d377ca515e4c6a6af00a0ce7
font_14_sfnt_off00bac108.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC108 8020 bytes
SHA-256: f8ded09403dc80e3b025c711ed891a71326762c7e43f34894346de33f065fe7a
font_15_sfnt_off00bad9ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAD9ED 1560 bytes
SHA-256: 945cfe048909c322b55a8a2fea331af4df81b1fe2352b5966635f467d6ebf1fe
font_16_sfnt_off00bae085.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAE085 9668 bytes
SHA-256: 6537d7abc7616a6d0192b88efe725b1c0b2756076a7fb024a507216f012a6c6d
font_17_sfnt_off00bafeff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAFEFF 7580 bytes
SHA-256: 4df9d4d70a20fc90ddd6999695faf19009cc9f84eba3556dda81292d922f75a5
font_18_sfnt_off00bb16b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB16B6 8924 bytes
SHA-256: 8f708ea0f4120773fa5f0d1743e17d350790063fd326b05edf2acbe680911a37
font_19_sfnt_off00bb316a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB316A 1476 bytes
SHA-256: 8c3d3fd3e14a001aebaa8f31ab9f5c29413a7b7775dce0324fc2d36a45000273
font_20_sfnt_off00bb38b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB38B9 8444 bytes
SHA-256: c9cbe4b211c5482b85ea9a9e8af7a44b4289cd64c59a496412a878cf123e6a38
font_21_sfnt_off00bb51c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB51C3 7572 bytes
SHA-256: 240a9376144ea49afcd900a1bc4079c57678532686e7eba43f00a12f032cd4bc
font_22_sfnt_off00bb697e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB697E 9700 bytes
SHA-256: 0483644a56e4f10b471a232ff17b9c6a56bcb5ed4305927833ff08674fb95ad1
font_24_sfnt_off00bb8c1f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB8C1F 1444 bytes
SHA-256: d1f233080b49cb859aa8181203ae94e41ecce5711632d89519719aab067c94b7
font_25_sfnt_off00bb9226.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB9226 6140 bytes
SHA-256: 5a549d0cf6c6ddd0376446cda53def132b95825b8d8b14dbfcfade3b555c0c71
font_26_sfnt_off00bba367.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBBA367 1572 bytes
SHA-256: a342dd264a0d0199e19a411ef6331ab751ab4abaefae329fdf6d1ef9ad125e7e
font_27_sfnt_off00bba9df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBBA9DF 50556 bytes
SHA-256: 36578d27ebc766f55ba61a2f962b79f8212b684934527aedbd58999622109725
font_28_sfnt_off00bc3f61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC3F61 7408 bytes
SHA-256: 2d3bc56919cee0c6e55ef29ea030cb7242a859508c9223fb4faec4d316084934
font_29_sfnt_off00bc5641.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC5641 8848 bytes
SHA-256: 90eacc22f281ad1f816d0967559187ef8b389eaaa426b70196a5552a54dadb4d
font_30_sfnt_off00bc70b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC70B3 8924 bytes
SHA-256: 995d1c5b92c5d2b17324b0fe26dafbb0168aa7828821a274b2e2863191946542

Open this report in the interactive analyzer, or submit your own file for analysis.