PDF static analysis report

Static analysis result for SHA-256 90bdbe0a1257554e…

SUSPICIOUS

PDF

48.7 KB Created: 2020-04-04 09:43:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: c633ac01dcca4f8af8942f9022d8492b SHA-1: 49da3253d7d489de19e4d11f2d44f7c50cda0411 SHA-256: 90bdbe0a1257554eecf947a9dab56eb4b542b05bee2397bc19e2cb1babf7c769
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The ML classifier strongly indicated maliciousness in this PDF. The document contains multiple embedded URLs, with the primary one pointing to 'danahensler.com' and containing a suspicious anchor text related to social engineering. This suggests the document is designed to trick users into visiting a potentially harmful site. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danahensler.com/uploads/1/3/0/7/130775172/130775172.html#tavistock+institute+social+engineering+the+masses+pdf PDF link annotation
    • http://thegardenstategreat.com/uploads/1/3/0/2/130271098/lataf.pdfIn PDF document text
    • http://a6art.com/uploads/1/3/0/5/130588786/zotuwave.pdfIn PDF document text
    • http://wallace-cc.us/uploads/1/3/0/7/130740078/6600202.pdfIn PDF document text
    • http://dekeruza.ca/uploads/1/3/0/2/130272472/7108907.pdfIn PDF document text
    • http://ckginspired.com/uploads/1/3/1/4/131410090/vizalowi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000751f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x751F 8420 bytes
SHA-256: 4203c175f1d7da7dbc8d2d56386770df70857e07c714735f4f14a4d3fc1a266a
font_01_sfnt_off00009569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9569 2648 bytes
SHA-256: 2c32c498f23db3cae400dac070c72b38d41a5d5dbe5041cbe08e7cee44e1acfd
font_02_sfnt_off00009eb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9EB9 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63

Open this report in the interactive analyzer, or submit your own file for analysis.