PDF static analysis report

Static analysis result for SHA-256 6c0523aa1857f1b6…

SUSPICIOUS

PDF

91.5 KB Created: 2018-06-11 08:42:07 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-04
MD5: efe4c3fb00cf823d7a99e5c650927ff3 SHA-1: 4aec7b79d20ed4b33dd412424cf11322e451c50f SHA-256: 6c0523aa1857f1b63866c12843ba6efb12c6f0d14b44459538cd66356ebc7402
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1115

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=trig-regents-jan-2011-answers.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=trig-regents-jan-2011-answers.pdfIn PDF document text
    • http://www.nysedregents.org/a2trig/home.htmlIn PDF document text
    • http://www.jmap.org/JMAPRegentsExamArchives/ALGEBRA2TRIGONOMETRYEXAMS/ExamAnswers/0111a2ans.pdfIn PDF document text
    • http://www.nysedregents.org/a2trig/archive/20110125-a2trig-rg.pdfIn PDF document text
    • http://danili.de/trig/regents/trig_regents_jan_2011_answers.pdfIn PDF document text
    • http://drlogo.de/trig/regents/trig_regents_january_2011_answers.pdfIn PDF document text
    • http://osscom.de/trig/regents/trig_regents_january_2011_answers.pdfIn PDF document text
    • http://hihugo.de/january/2011/january_2011_trigonometry_regents_answers.pdfIn PDF document text
    • http://habnix.de/january/2011/january_2011_trigonometry_regents_answers.pdfIn PDF document text
    • https://greeningeducation.co.uk/books/153334/trig_regents_january_2011_answers.pdfIn PDF document text
    • http://riverside-resort.net/1/stars-suite-integrated-math-answer-ke.pdfIn PDF document text
    • http://riverside-resort.net/1/the-stars-grow-pale.pdfIn PDF document text
    • http://riverside-resort.net/1/solution-manual-to-quantitative-chemical-analysis.pdfIn PDF document text
    • http://riverside-resort.net/1/two-nations-live-on-the-edge-answers.pdfIn PDF document text
    • http://riverside-resort.net/1/tourism-planning-and-management-1st-edition.pdfIn PDF document text
    • http://riverside-resort.net/1/solution-statement-examples.pdfIn PDF document text
    • http://riverside-resort.net/1/uncertainty-and-optimality-probability-statistics-and-operations-research.pdfIn PDF document text
    • http://riverside-resort.net/1/the-philosophy-of-leibniz.pdfIn PDF document text
    • http://riverside-resort.net/1/training-needs-analysis-questionnaire.pdfIn PDF document text
    • http://riverside-resort.net/1/the-key-to-calm.pdfIn PDF document text
    • https://greeningeducation.co.uk/books/153334/trig_regents_januaryIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://answers.yahoo.com/question/index?qid=20110124135804AAqwltWIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_024_off00008e1a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8E1A 154 bytes
SHA-256: e479076dc68e23f3a47a8f7f794f521d6e2d1cf05ed99b06de9f782f86d9337e
font_00_sfnt_off00011384.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11384 14528 bytes
SHA-256: d032cd1f74706d5f957f316c113ba8c8f4aa1c84fbb8be0d511a8ef1b9f9aca7
font_01_sfnt_off0001404b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1404B 9656 bytes
SHA-256: 0e7ce70ccc34b7096bc47aec9358576b6cf2f20b4f043deaccedfe7b0fbc6fb7

Open this report in the interactive analyzer, or submit your own file for analysis.