PDF static analysis report

Static analysis result for SHA-256 5cab615927d5ffda…

CLEAN

PDF

73.4 KB First seen: 2013-08-11
MD5: 3ce1a43fdbb3479ac327f1361e95f0e6 SHA-1: 6a67e66223bfd5aa51feebe59321b286a90d5371 SHA-256: 5cab615927d5ffda6d4af70479b1334c5269003b0dd070e3424eb1ac9ed7f7ae
18 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0700

Heuristics 3

  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neeviaPDF.com In PDF document text
    • http://www.puremobile.com/help.aspIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xdp/In PDF document text
    • http://www.xfa.org/schema/xci/1.0/In PDF document text
    • http://ns.adobe.com/xtd/In PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • http://ns.adobe.com/xfdf/In PDF document text
    • http://www.xfa.org/schema/xfa-form/2.8/In PDF document text
🗂 Part of campaign: neeviapdf.com 53 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin pdf-embedded-file PDF EmbeddedFile object 1 at offset 0xD225 85 bytes
SHA-256: c06dcd026a7ea0536b63e07ce688691b585339a3ab7ff59065e546b56308c7bb
embedded_file_obj0002.bin pdf-embedded-file PDF EmbeddedFile object 2 at offset 0xD2D5 228 bytes
SHA-256: 24c130f03a4cf51d470b536e94c1e58af67665739e200e0ce198ad41086243c0
embedded_file_obj0003.bin pdf-embedded-file PDF EmbeddedFile object 3 at offset 0xD40A 45378 bytes
SHA-256: 2cebfa6b0edbab1197713eb0783925606b1c5a0c195165ee3c8c362f484191ab
embedded_file_obj0004.bin pdf-embedded-file PDF EmbeddedFile object 4 at offset 0x10B42 199 bytes
SHA-256: c97e0522381d6196cc0695f35f4d065f15c9c86a9601a7f776c6afd3f4c6b460
embedded_file_obj0005.bin pdf-embedded-file PDF EmbeddedFile object 5 at offset 0x10C2E 119 bytes
SHA-256: 846dfecc0c93797cb6db4301f6af323fffd76ffdf8c053c439495412785138e7
embedded_file_obj0006.bin pdf-embedded-file PDF EmbeddedFile object 6 at offset 0x10CE1 77 bytes
SHA-256: e6c26a3478346d27e841ad49868ebf68bf4c6863b6750e8d60bda3c4c6f79876
embedded_file_obj0007.bin pdf-embedded-file PDF EmbeddedFile object 7 at offset 0x10D86 262 bytes
SHA-256: ac7326cf61e76a3d8e26bf2dbc2293633b3773da25139a2255daa9f29d0a5df5
embedded_file_obj0008.bin pdf-embedded-file PDF EmbeddedFile object 8 at offset 0x10E96 140 bytes
SHA-256: 08e960f9e24d1ec6a1b4fb1545c43d4b59367522eaf9eef080c0eb1f5852687b
stream_004_off000010b2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10B2 34056 bytes
SHA-256: abad6f91eafdb0e083580077f31cb616896fd8ea7751010400f0df402685eed0

Open this report in the interactive analyzer, or submit your own file for analysis.