PDF static analysis report

Static analysis result for SHA-256 984357b9d2eb96c7…

SUSPICIOUS

PDF

34.0 KB Created: 2018-09-25 23:45:44 -07:00 Authoring application: G. S. (via S. A.) First seen: 2019-06-27
MD5: 52e04ff6e9bad152ec0803bdd5f1bd02 SHA-1: 89bb3f99d248627ca8ec5ba3e1532e622b043d4e SHA-256: 984357b9d2eb96c726f7ec8ec8ae13b4552c93513e131af8e2d20a3e7aabfc08
44 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure for a "secure document" which directs the user to click on a non-reputable URL. This URL likely leads to a credential harvesting page or a further stage of malware delivery. The document body text explicitly instructs the user to "Click here to log on with your e-mail and view document", reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier clean score 0.0066

Heuristics 3

  • PDF credential / secure-document lure with a single non-reputable link high PDF_CREDENTIAL_LURE_NONREPUTABLE_LINK
    PDF is a thin document whose rendered text is a credential / secure-document / identity-verification lure ('secured Adobe PDF document', 'identity verification required', 'fichier sécurisé — voir le document') and whose only clickable action is a single external link to a host that is not known-good. This is the text-layer variant of the malspam carrier that the image-only lure rule (which requires an image-heavy, near-textless page) cannot see. Flagged suspicious: the lure text plus a lone non-reputable link is the corroboration.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://storage.googleapis.com/eer6125er61fer51f5er1f5e/docpage.html PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: radpdf.com) 3 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001013.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1013 8392 bytes
SHA-256: 2c2a681c17529f19d044da54ac0edd02c2f693ca78e37aecccf6fb0297a8ee92
font_01_sfnt_off0000283a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x283A 10660 bytes
SHA-256: 116562d0c98426cc8a7009c553ae167e4f0d03cf7b6774b9754decb895b141b8
font_02_sfnt_off000040a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40A2 12044 bytes
SHA-256: ec00b8b1e8da89dfcea0f7b73a06192559316f58a97cd34c2a13975e94061697

Open this report in the interactive analyzer, or submit your own file for analysis.