Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8e1b697cbca3c3a…

MALICIOUS

PDF

450.4 KB Created: 2005-07-25 10:23:45 -03:00 First seen: 2014-03-27
MD5: a3030d66f3371dbc69f105472b5de97b SHA-1: 00a15269053db95d2d2b600383654cb3d12b17a7 SHA-256: a8e1b697cbca3c3a70b2b6595677999fe768051b6844d1c862c61e5988e70f93
62 Risk Score

🔏 Digital signature Signature invalid

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF digital signature is cryptographically invalid medium PDF_SIGNATURE_INVALID
    A signature's CMS failed verification: either the signer's signature over the signed attributes is invalid, or the signed content digest does not match the bytes the ByteRange covers. The signature was tampered with, forged, or the signed content was altered.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn PDF document text
    • https://www.verisign.com/repository/CPS��In PDF document text
    • https://www.verisign.comIn PDF document text
    • https://www.verisign.com/repository/verisignlogo.gif0��In PDF document text
    • https://www.verisign.com/CPS0bIn PDF document text
    • http://www.microsoft.com/truetype/0In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00065ecf.icc pdf-icc-profile PDF ICC profile at offset 0x65ECF 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00056dd6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56DD6 11040 bytes
SHA-256: 3abe01efbc63159b4891dc4d93868aeb4bd4ac8e2cb7c41f799068d773b5b23d

Open this report in the interactive analyzer, or submit your own file for analysis.