PDF static analysis report

Static analysis result for SHA-256 72931557245caa6e…

SUSPICIOUS

PDF

298.8 KB First seen: 2019-12-09
MD5: d8d18c9264b79af12969b9e34d118eda SHA-1: e14a0a205d7442e57ff534add186dc015f7b3d1c SHA-256: 72931557245caa6ef9d139f03bf8e78d6c5676025aa907c5f7f4a161981c6c5c
44 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document that uses a cloud document lure, impersonating services like SharePoint or OneDrive. It contains a shortened URL (https://is.gd/1qvsgx) which is a common tactic to obscure malicious destinations. The heuristic 'PDF_URL_SHORTENER_URI' confirms the presence of a URL shortener. The document's structure and embedded content suggest it's designed to prompt user interaction, likely to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 4

  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.radpdf.com In PDF document text
    • https://is.gd/1qvsgxIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000006b1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6B1 9684 bytes
SHA-256: dde2a029d460fcc5ba06ae4fbdacb3d6506dc08cc6f5fb94cf15c2ffc41a8bfa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
69 of 135 identifiers look randomly generated (e.g. 'lbHZldGljYTt9CntcY29sb3J0Ymw7XHJlZDI1NVx') — consistent with name-mangling obfuscation. Carved artifact contains 28 long base64-like blob(s).
stream_007_off00002aa9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2AA9 187484 bytes
SHA-256: c330c39d8d0d954382ac292a4b508aba0fd9d0de65c52855953ed5a62f402020
font_00_cff_off00024c6d.bin pdf-font-stream PDF embedded font (cff) at offset 0x24C6D 753 bytes
SHA-256: 08c9a75a51dca4baf86dbbf02b44a8d809e8d2bb40126e92adada6d6c2f7ee46
font_01_cff_off00024f6d.bin pdf-font-stream PDF embedded font (cff) at offset 0x24F6D 2903 bytes
SHA-256: af16b1e1fc00712994cf5e437a38be487c8a5f2aee4ef8a9ba2433bca1a2984e

Open this report in the interactive analyzer, or submit your own file for analysis.