PDF static analysis report

Static analysis result for SHA-256 7b5f552ba55d9b39…

SUSPICIOUS

PDF

71.5 KB Created: 2018-06-11 08:37:15 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-04
MD5: ba2a86451927f364c26e1decd1cae959 SHA-1: 8d08f3f073b2f08d31033574f70057fb59695211 SHA-256: 7b5f552ba55d9b390896845a9cc65fdc2ee1c05d201935a7fcbf40376d1f5acc
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0880

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=use-case-diagram-for-social-networking.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=use-case-diagram-for-social-networking.pdfIn PDF document text
    • http://www.conceptdraw.com/How-To-Guide/uml-use-case-diagram-example-social-networking-sites-projectIn PDF document text
    • http://infoda.de/use/case/use_case_diagram_for_social_networking.pdfIn PDF document text
    • http://drabbi.de/use/case/use_case_diagram_for_social_networking.pdfIn PDF document text
    • http://toweko.de/use/case/use_case_diagram_for_social_networking.pdfIn PDF document text
    • http://zorama.de/use/case/use_case_diagram_for_social_networking.pdfIn PDF document text
    • http://www.conceptdraw.com/examples/use-case-diagram-for-facebook-websiteIn PDF document text
    • http://www.ictliteracy.info/rf.pdf/Social_Network_design_spec.pdfIn PDF document text
    • http://amalva.de/use/case/use_case_diagram_for_social_networking.pdfIn PDF document text
    • http://riverside-resort.net/1/windows-group-policy-resource-kit-windows-server-2008-and-windows-vista-pro-resource-kit.pdfIn PDF document text
    • http://riverside-resort.net/1/yamaha-golf-cart-service-shop-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/utos-ng-hari-at-iba-pang-kuwento-jun-cruz-reyes.pdfIn PDF document text
    • http://riverside-resort.net/1/world-history-vocabulary-activity-19-answers.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-irresistible-revolution.pdfIn PDF document text
    • http://uncpbisdegree.com/1/suzuki-escudo-1992-auto-transmission.pdfIn PDF document text
    • http://riverside-resort.net/1/unit-8-answers-gateway-b1.pdfIn PDF document text
    • http://uncpbisdegree.com/1/speedstream-5100-modem-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/yamaha-raider-owners-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/writing-paragraph-about-cooking.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://creately.com/diagram/example/gwb5aecm/socialIn PDF document text
    • https://stackoverflow.com/questions/8002613/is-this-class-diagram-correct-according-to-this-use-case-diagramIn PDF document text
    • http://en.wikipedia.org/wiki/Use_case_diagramIn PDF document text
    • https://www.scribd.com/doc/88338894/Social-NetworkingIn PDF document text
    • https://www.scribd.com/doc/62184607/Social-Networking-Projet-Part4In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://stackoverflow.com/questions/8002613/is-this-class-diagramIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA81 13796 bytes
SHA-256: b3e9a471f7b1c1ebd578e4e08cee13908c75782e6b9887238feada0e7a6ccc0c
font_01_sfnt_off0000f524.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF524 8896 bytes
SHA-256: 6e9bffd01bf8758d7527c86ebeece1ff0637b1f82103a3dce97a1e04988a500b