PDF static analysis report

Static analysis result for SHA-256 660f9aaa0e372c44…

CLEAN

PDF

4.1 KB Created: 2015-06-06 00:16:04 Authoring application: HTML2FPDF >> http://html2fpdf.sf.net (via FPDF 1.52) First seen: 2015-08-19
MD5: 32f7d4d7cba22ea8ddc73c074ef9b54e SHA-1: 633e05c6a259de4ee1e9c615c6511688c90a0f45 SHA-256: 660f9aaa0e372c44479429be076b2f11b6d235210a305fa91f1e023d38ee9d95
12 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains embedded JavaScript and external URIs pointing to suspicious domains. The document body, while truncated, mentions 'prednisone' and 'viagra' alongside pharmacy-related terms, suggesting a lure for potentially illicit pharmaceutical sales or phishing. The embedded JavaScript and external URLs are indicative of an attempt to redirect the user to malicious sites for further exploitation.

Machine Learning

  • Nyx PDF Classifier clean score 0.0126

Heuristics 3

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lifecoachtoloseweight.com/rtjoiumav-pills-viagra/ PDF link annotation
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/healthy-male-sirius-radio.pdfIn PDF document text
    • http://www.powereagleusa.com/wp-includes/js/jcrop/pdf.php/buy-cialis-online-with-paypal.pdfIn PDF document text
    • http://html2fpdf.sf.net)/CreationDateIn PDF document text
    • http://html2fpdf.sf.netIn PDF document text
🗂 Part of campaign: sf.net 56 samples