PDF static analysis report

Static analysis result for SHA-256 6b0117397cff7246…

CLEAN

PDF

2.21 MB Created: 2015-07-29 07:14:07 +09:00 Authoring application: Microsoft® Word 2010 First seen: 2019-02-26
MD5: be26fa851281a90b0989596ce60b538f SHA-1: 27a10e8aeb100bd14e366ee518b5d9b8c75bcecd SHA-256: 6b0117397cff7246718e558fcf02312f4ece446a81e330f54c538f609407089a
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://scan.netsecurity.ne.jp/article/2013/12/20/33227.html In PDF document text
    • http://www.bing.com/images/search?q=%e3%83%99%e3%83%8d%e3%83%83%e3%82%bb%e3%82%b3%e3%83%bc%e3%83%9d%e3%83%ac%e3%83%bc%e3%82%b7%e3%83%a7%e3%83%b3%e3%80%80%e6%bc%8f%e6%b4%a9&view=detailv2&&&id=78DE2AC22C817A2D9E37B9658C5BB983E09B82DA&selectedIndex=54&ccid=KQLFYfKX&simid=608053282522857623&thid=JN.19NrSZ3ItdWTWcisbTq4qQPDF link annotation
    • http://techtarget.itmedia.co.jp/tt/news/1504/01/news02.htmlIn PDF document text
    • http://japan.zdnet.com/article/35062215/In PDF document text
    • http://www.fireeye.com/jp/ja/resources/pdfs/press-releases/2013-04-04-ATRRelease_J.pdfIn PDF document text
    • http://www.symantec.com/ja/jp/about/news/resources/press_kits/detail.jsp?pkid=norton-report-2013In PDF document text
    • http://www.symantec.com/content/ja/jp/about/presskits/2013_Norton_Report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000d43.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD43 45318 bytes
SHA-256: 8f99631089621e9c672f44c5c52bf177b8c6268e6c157cdd62312eccde420a50
stream_050_off00066284.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x66284 365976 bytes
SHA-256: 92df4ef2166fd61fa72b2ad499474928eb4ba34499f02007944560873a925f32
stream_052_off0007a6cc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7A6CC 537532 bytes
SHA-256: d803545cf37d7e32101035435988dc81b8230e2d56bc95cfcaf11db7cafdcabb
stream_054_off0009c4c7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9C4C7 766176 bytes
SHA-256: 033812cdbcae3aa322d7ccb3b61b240b39ed5a592fe39d0d648b9508a84a3c0f
stream_058_off001055d5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1055D5 485648 bytes
SHA-256: 377a17646aabeddd320db4affa3b72a4eb45e4a295ba7fef13fa69117aa037c2
icc_00_off00211d10.icc pdf-icc-profile PDF ICC profile at offset 0x211D10 1960 bytes
SHA-256: 283e482d9b10db98fb7df2f6ef4bdf4ddf8de5a07d2c7530cc361ec4b29ed39a
icc_01_off0022d796.icc pdf-icc-profile PDF ICC profile at offset 0x22D796 6924 bytes
SHA-256: 2273d08d48a213a724cac68e883fcf6e4525d4815d5f68c0ae90b2b4dd458de8
icc_02_off00234a4a.icc pdf-icc-profile PDF ICC profile at offset 0x234A4A 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off0022f375.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22F375 1600 bytes
SHA-256: 8e8eb01fef19a8177ae1f913beed38d08e65011525de001e2ff0d4d721d34b8f
font_01_sfnt_off0022fc26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22FC26 7852 bytes
SHA-256: 8ea6cc4463ac9447561c2956b1a1b8250d6f91ced8f23909fc4f2253b0095096
font_02_sfnt_off00231695.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x231695 17188 bytes
SHA-256: 6517d626d692d697424e97d83252c38a0ed834dc7d7b3ef456136ce3a5751e35

Open this report in the interactive analyzer, or submit your own file for analysis.