PDF static analysis report

Static analysis result for SHA-256 9d6f8a8fa1fe3ce7…

CLEAN

PDF

4.7 KB Created: 2015-06-04 02:58:42 Authoring application: HTML2FPDF >> http://html2fpdf.sf.net (via FPDF 1.52) First seen: 2015-07-16
MD5: a85f8575f1f220bcbaf0dcaf83612ce4 SHA-1: 6effc97e130f3b3b36cb1e20fc90effa00af07ef SHA-256: 9d6f8a8fa1fe3ce7bd68895dc235d282f3db9e3b8bfbe39c4dd6270dfee07aa5
12 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains embedded JavaScript and multiple external URIs pointing to pharmaceutical-related websites. The document body text also contains similar URLs and content related to drug sales, suggesting a spam or phishing campaign. The embedded JavaScript stream (PDF_JS) and external URIs (PDF_URI) are indicative of malicious intent to redirect the user to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 3

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.samfab.com/Scripts/js/pdf.php/lowest-price-viagra.pdf PDF link annotation
    • http://www.ideasincfab.com/female-viagra-pills/In PDF document text
    • http://www.samfab.com/Scripts/js/pdf.php/cialis-cheap-online-pharmacy.pdfIn PDF document text
    • http://www.plushaut.net/site/js/cialis-in-canada/In PDF document text
    • http://html2fpdf.sf.net)/CreationDateIn PDF document text
    • http://html2fpdf.sf.netIn PDF document text
🗂 Part of campaign: sf.net 56 samples