PDF static analysis report

Static analysis result for SHA-256 96664c5a1342731f…

CLEAN

PDF

190.3 KB Created: 2018-06-13 12:21:01 -05:00 Authoring application: Microsoft® Word 2016 First seen: 2019-08-04
MD5: a59f528661565f62cb23ac5ff569be2c SHA-1: 8f3d3ae95612874fa5f904ba2c9157fa00f8c63a SHA-256: 96664c5a1342731f8ec6d8f486af64bfe121bc540c449315259a48c230fb53b8
24 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains embedded URLs pointing to suspicious domains, suggesting a phishing or malware distribution attempt. The presence of these external links, combined with the document's metadata indicating it was authored by Microsoft Word, points towards a social engineering tactic. The primary malicious URLs identified are 'https://elsworthysolicitors.com.au/fire/Fresh%20doc/docusignupdated/docusign/Validation/index.php' and 'https://valvetech.sa/acilac/amg/index.php'.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • Document signing service impersonation lure medium SE_DOCUSIGN_LURE
    Document impersonates DocuSign, Adobe Sign, or a similar signing service in a signing-request context
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://elsworthysolicitors.com.au/fire/Fresh%20doc/docusignupdated/docusign/Validation/index.php PDF link annotation
    • https://valvetech.sa/acilac/amg/index.phpIn PDF document text
    • https://ci5.googleusercontent.com/proxy/SGbD_3LTCHSFWu_JFVvgacgTp3DlnBjz61Oo0zGC67ZK50bOqnppBI3_6C_yvGBNxU32L-qTJUxPnLXreXK1q1Ky96tGXSZKdlLi3zCnz7FvlD2hM9pW=s0-d-e1-ft#https://www.docusign.net/member/Images/email/docGeneric-white.pngIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.