Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba03ef424f5bbc3c…

MALICIOUS

PDF

84.5 KB Created: 2023-04-27 09:41:28 +03:00 Authoring application: iTextSharp’ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)
MD5: de0ae8425f58766b943ca7fbf20dfe48 SHA-1: e3b23bc7a0d3f10dd1fda0b4c921838ef9909b76 SHA-256: ba03ef424f5bbc3c3b759dec112327ae1f69fa9f8c2bf4bf2a0620148f4bd300
60 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The PDF contains a direct link to a ZIP archive, identified by the PDF_DIRECT_PAYLOAD_LINK heuristic. The embedded URL http://jeblos.com/pki/64481de1eb084.zip is presented as the primary content, indicating a social engineering attempt to trick the user into downloading and executing a malicious payload. No scripts were extracted, but the direct payload link is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.0049

Heuristics 2

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jeblos.com/pki/64481de1eb084.zip

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off00000867.bin
dc170c6f02f2b156352671fad65a9bda5b1469f65970b14b93d1b21cf765ef1b		 pdf-font-stream PDF embedded font (cff) at offset 0x867 2830 bytes
font_01_cff_off00001c3d.bin
48f071b076d21a1933c623ff4b19b4372ec84f662e8b5ca45a5845fa869e6427		 pdf-font-stream PDF embedded font (cff) at offset 0x1C3D 1675 bytes
font_02_sfnt_off0000301e.bin
dabca5bdd40353909ac18470e44e9982ebe51b0d3b2f342d78126ed3548b0529		 pdf-font-stream PDF embedded font (sfnt) at offset 0x301E 5360 bytes
font_03_sfnt_off00004270.bin
f034645ad92baf4f01365910fa6acf564b8f4da4489ceb3ccaa99230a4139ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4270 7016 bytes
font_04_sfnt_off00005a4e.bin
2e140c78ba7a3deff895a12e3ef243ce609aa29c91ae9b82f5f04207a22e0655		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A4E 6120 bytes
font_05_sfnt_off00006ed6.bin
bcee5ba7d8cfb2e16dcee3a21900987f039f2c0243a316e3a11267d9f4248705		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6ED6 7272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.