PDF static analysis report

Static analysis result for SHA-256 a422cc49e2af2281…

CLEAN

PDF

82.6 KB Created: 2017-01-05 15:03:54 +08:00 First seen: 2018-10-07
MD5: 4a03dcd8dad59d0b3803e4ec6c4c6bf4 SHA-1: ff707f0caa9395856f83750a1d8e5b6d6e70d55f SHA-256: a422cc49e2af2281995c929b2a1f2426c79fa6e9af715c1e3e7d9ecc56846bf1
22 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0405

Heuristics 2

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://79.172.211.32/mail/GiexwuJiwwf_fxddnbrkenvPxriP16366283zzt.pdf PDF link annotation
    • http://www.alistatrans.ru/bbs/nzcmwQYtletrscu16354439J.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/hhivsxd_xmYfuh16354228me.pdfIn PDF document text
    • http://79.172.211.32/mail/ncteofmeatJwadzf16357316l.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/fbfcnnslm_zfid16367020mkh_.pdfIn PDF document text
    • http://79.172.211.32/mail/GiJztczneeQoaxrdJxxiub16357723oz.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/ffrxufuaooPseeaddcxYtuxulhadQQ16349213vkzx.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/dPm16350171ikQ.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/uPerJQcv_16349677Qsv.pdfIn PDF document text
    • http://79.172.211.32/mail/PrbGuaQYxxbPzPkblrdwlQleeGQio16357747mc.pdfIn PDF document text
    • http://79.172.211.32/mail/saxYnzthJGQcsh16366294nrk.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/_Pw_ti__zuzut16349251vs.pdfIn PDF document text
    • http://79.172.211.32/mail/mbtJiQnnfQY16357640bJkP.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/zkhosnJvhfJG16367030vxmc.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/rlGmYYYwsiukvcQ16350125vua.pdfIn PDF document text
    • http://79.172.211.32/mail/QcnlkseovkikshlvuxauazPchkb_16357309l.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/xPGorotGxboi16349697wtx.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/exrzfQuGQxohxmcQk16355012rxbw.pdfIn PDF document text
    • http://79.172.211.32/mail/xYtlcJ16357595c.pdfIn PDF document text
    • http://79.172.211.32/mail/xutakGlvGvG16366295w_u.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/hrhPcwefs_mb16354759Pe.pdfIn PDF document text
    • http://79.172.211.32/mail/mnvceasckQztsPmeGixGrnku_Y16366267m.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/locYnYPomximYvfuefkQzdh16354835rcG.pdfIn PDF document text
    • http://79.172.211.32/mail/leril16357978h.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/abtrrQrkJJGxuQYzmtecskPPbxddiw16358813P.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/hsumQvd16358191dlb.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/kulJbv_GcxhlssfflzGdzdhwnsh_tf16358581Qe.pdfIn PDF document text
    • http://79.172.211.32/mail/aiazGQYvkd16357277xi.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/zfJ_bhhlrQksvk16366986dfb.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/xGbrtikabm16354191xv.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/zkiwiiaPamYYYmohJuinilh16358434vac.pdfIn PDF document text
    • http://79.172.211.32/mail/nckzQwarvudPhsQQPrsnflGber16357202sQa.pdfIn PDF document text
    • http://79.172.211.32/mail/wsliltd16357784aQid.pdfIn PDF document text
    • http://jpf.vuzf.bg/mails/vPkwzuvn12529680_.pdfIn PDF document text
    • http://creative-dots.com/wholeclass/Gxbma16223873czmJ.pdfIn PDF document text
    • http://ide.plandiv.gov.bd/wp-content/Qek15800705s_x.pdfIn PDF document text
    • http://ide.plandiv.gov.bd/wp-content/xnosrvGbnweell15815185r.pdfIn PDF document text
    • http://ns4.asconbs.dk/logs/kcotcbmxmsimuPahtvrsoPt16213612u.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/xxfx16349939h.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/zkPGvubke_JcGfoePftu16349651ctQt.pdfIn PDF document text
    • http://79.172.211.32/mail/ekuzrGtslYczJoJ_PPedYm16358169Gesd.pdfIn PDF document text
    • http://79.172.211.32/mail/suhxvvrt16357867to.pdfIn PDF document text
    • http://79.172.211.32/mail/rYizc_leoi16357648l.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/JttPrftsev16358519vtY.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/wnrewtJxexxbiedtGePfhl16349393sf.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/cGmvttGrfhzf16349672ruwP.pdfIn PDF document text
    • http://thestoveinstallationcompany.co.uk/historydepartment/wbGlkfx_xmsztQwkYdhbrwmJGnG_Qf16349469r.pdfIn PDF document text
    • http://www.laureati.cz/perhapsorganize/tuG16358729GYri.pdfIn PDF document text
    • http://79.172.211.32/mail/ePGn16357382YJnw.pdfIn PDF document text
    • http://www.alistatrans.ru/bbs/xwasamvlwzhnxofuox16354380m.pdfIn PDF document text
    +26 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000a402.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA402 19824 bytes
SHA-256: 05e7934647d3f80f115b5ed591f547e245d8ce2d34dac355b155c8a1df6b3e02
font_01_sfnt_off0000d973.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD973 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00010f36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F36 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1

Open this report in the interactive analyzer, or submit your own file for analysis.