PDF static analysis report

Heuristics 3

• Clickable URL embeds a recipient email address as a tracking parameter high PDF_URL_RECIPIENT_EMAIL_PARAM
  PDF has a clickable HTTP(S) action whose URL carries a recipient email address as a query parameter (e.g. '?e=victim@example.com') on a host that is not known-good. Phishing kits stamp the target's address into the link so the landing page pre-fills the credential form and tracks the open per recipient; a delivered legitimate link rarely carries the recipient's address in cleartext. Complements PDF_URL_MAILMERGE_PLACEHOLDER, which catches the unrendered token.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://authupgrademaibxo365oofice-oblanceolate-newscasting.eu-gb.mybluemix.net/ssucres/?UBXazT150=f0223761747036720b1f1f11c41351b4&ip=09/27/2018&te=dadeschools.net&UBXazT150=IT PDF link annotation

  • http://dejavu.sourceforge.netFontsIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.