PDF static analysis report

Static analysis result for SHA-256 5538f017df2e1401…

SUSPICIOUS

PDF

17.28 MB Authoring application: Adobe Illustrator 16.0 First seen: 2015-06-23
MD5: e9292113f96b21d677800841945625fc SHA-1: f5252a916712694f0352e02df3e7d23cf9d913d4 SHA-256: 5538f017df2e1401bbb620ab0ba303a80f98180c8f5c477f0f2ec27769682b98
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0896

Heuristics 5

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • Optional Content Group with action trigger low PDF_OPTIONAL_CONTENT
    Optional Content Group (layer) co-occurs with an action trigger — content can be selectively hidden from viewers or scanners while the action still fires on open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Font#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00a140fc.icc pdf-icc-profile PDF ICC profile at offset 0xA140FC 654352 bytes
SHA-256: da2b9b593e27cba2563cbc8596071c5c8f2395d3dbb4434538bac2bc9d58ce77
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
font_00_sfnt_off00021462.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21462 134390 bytes
SHA-256: c60630d37d7e5d0379b26c45cb55b25ec5b425a928c078e095753979139f10a5
font_01_cff_off009f711a.bin pdf-font-stream PDF embedded font (cff) at offset 0x9F711A 2178 bytes
SHA-256: a3aea4f07c83e1185fbaf9b07d58845e86a99e19b43d9bfbe8c7089225c3ba15
font_02_sfnt_off00c35d52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC35D52 325406 bytes
SHA-256: b575b49e77a83dc21553a1c8c6726ebe2186cad5837cb5438212455b090b6ae1

Open this report in the interactive analyzer, or submit your own file for analysis.