PDF static analysis report

Static analysis result for SHA-256 bf7e6cc2903920cc…

CLEAN

PDF

88.2 KB Created: 2016-12-26 17:59:43 +08:00 First seen: 2019-01-11
MD5: 3c31a300f65c3a427fdc0852e05027b5 SHA-1: 6c620b0714a2b1d768e3e820f3f664573e3e96ea SHA-256: bf7e6cc2903920cc4ed2c4f350ca0e34c98e9764b3d6fef002ee3be7d14bfe60
12 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0313

Heuristics 3

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dubaipropertyrentals.net/pasttax/strongdepartment.php/hhxvYvlfev16219400oPG.pdf PDF link annotation
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/PlvdJxvrwaYfwrPzuwzvtxr_hxvlff16218593sP.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/xxes_eYiwwJzc_Pexenv16219220vas.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/YzQbm_JxYawxwkYxlhb16218738eQnY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/PnnmfrxztJfimGwttbPYiPsvewwaY16219411e.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/akszneaoePJvdwozuJztPv16219020lw_v.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/iirQauQ16218737J.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/tGxluofsQGxbzi__YPhxsbn16218488rm.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/rcfYvJbcGzJnbelbvavorn16218511_.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/siimelxQGvkdGthescdza16219196hc.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/rfQYfasokdlPb16219143YGhG.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/PfQltsbrhthGaetbGa16219289evc.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/crxvfnxoPnzPtnf16218754J.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/xhx16219234lh.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/_GQrGwkwucJzwlmJbaehaiPvtvJm16218729_x.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/YkQwuild16218822vuxQ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/kbPdxvhudufYo_kQrzk_ttu16218827ahJ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/nzGb16218592JPJ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/vwmcnoxmha16219153m.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/mhxPYQms_alz16219055l_sf.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/bJuevmrwkufmmwGxGs__lx16219114cca.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/YGldcPuk16218618kY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/ckc_vfstJ_au16219472lt.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/axeoscnGPGskGGhiPQ16219095Gdh.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/wzn_16219311l.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/bhGdtocbdebbGhkzan16219327fo.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/wmncxeYGcetlbwtxv_zv16219386rGl.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/xbltokn_xdJbteoQwG16219440swl.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/vPYuJb16218554wP.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/PmGoaPrwceJJdQxPQrwPmn_aesomG16219456mxxr.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/ezivnGr16219270G.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/hlzYr16219213bwYd.pdfIn PDF document text
    • http://www.partyservicedaro.nl/armboard/bocePJtGaewJ15912168Pbvk.pdfIn PDF document text
    • http://goldae.ch/js/wcGG_woovJ15805836l.pdfIn PDF document text
    • http://www.stripvip.com/release/rPGJeh11153551tmlv.pdfIn PDF document text
    • http://cardoor.es/talkremain/_enlz15407072o.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/cbfoQ16219190l.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/GdYtorbuoYcltkxx16219339lt.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/PchwdbPmomxsdnuwfYrud16218589iJ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/bbkscczabJ16218790Yf.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/wenid16218579rhe.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/slrJJhkzect16219054Gl.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/fvQmabccmJs_m_ctu_P16218914lf.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/ohkGtailQeYflsodurcJoliGJcve16219258b.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/koYdaw16219205Yoz.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/tJzmwPGYxPuwhnGJ16219001t.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/eGxlQtwbedJwrvtierbbtJaJGzi_16219422Yk.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/JclYGQhGkzQblxkJdPksnrclJtdwkP16218542fvr.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/noaJ16219281mJ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/pasttax/strongdepartment.php/mxcGcn_idctzwQixkx__rwatl16219183dYz.pdfIn PDF document text
    +25 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000b9ad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB9AD 19904 bytes
SHA-256: 02df1dbb5fd37065ffce0d7ec498fded54fecc59c4d54748f3cfe34f0843886c
font_01_sfnt_off0000ef4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF4F 20120 bytes
SHA-256: e2939fcf531d455abf749ebf84de5566aaa39f3833b139a3574a5ab247bb070d
font_02_sfnt_off0001258d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1258D 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1