PDF static analysis report

Static analysis result for SHA-256 7aae6e771aee8dd1…

SUSPICIOUS

PDF

298.8 KB First seen: 2019-05-31
MD5: 84ab216f7f6e3d398c3be219c54eddbb SHA-1: 1b0ebf3d84826b755162747fdaec99374c463be5 SHA-256: 7aae6e771aee8dd18982ac0c72662a4f8ed29081bd35c21f151fbf9909cf85d4
26 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document uses a cloud document lure to impersonate a file-sharing service, directing the user to click on an embedded URL. This URL leads to a suspicious external domain, likely intended to host a malicious payload or phishing page. No scripts were extracted, but the embedded URI and document lure strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 4

  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.radpdf.com In PDF document text
    • https://grifion-inf.online/Centrics4/sharePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000006b1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6B1 9706 bytes
SHA-256: 38f89209aba96e758f34baeee238c8dd64b4128a700fba31d6aaae2548346de5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
69 of 138 identifiers look randomly generated (e.g. 'lbHZldGljYTt9CntcY29sb3J0Ymw7XHJlZDI1NVx') — consistent with name-mangling obfuscation. Carved artifact contains 28 long base64-like blob(s).
stream_007_off00002abc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2ABC 187484 bytes
SHA-256: c330c39d8d0d954382ac292a4b508aba0fd9d0de65c52855953ed5a62f402020
font_00_cff_off00024c80.bin pdf-font-stream PDF embedded font (cff) at offset 0x24C80 753 bytes
SHA-256: 08c9a75a51dca4baf86dbbf02b44a8d809e8d2bb40126e92adada6d6c2f7ee46
font_01_cff_off00024f80.bin pdf-font-stream PDF embedded font (cff) at offset 0x24F80 2903 bytes
SHA-256: af16b1e1fc00712994cf5e437a38be487c8a5f2aee4ef8a9ba2433bca1a2984e

Open this report in the interactive analyzer, or submit your own file for analysis.