PDF static analysis report

Static analysis result for SHA-256 c3ca3d9fa7e00493…

SUSPICIOUS

PDF

155.1 KB Created: 2020-03-12 09:24:19 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: b03433271a0bf0c48995e858e8bfc185 SHA-1: 04c33b96b073a8203d2763c074c645e558ab706e SHA-256: c3ca3d9fa7e0049374d01d0f55b78100ad1e23adc970668a3e1fded20e5bbb97
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains embedded URLs that lead to other PDF files, suggesting a multi-stage download or redirection. The document body text, though partially corrupted, includes the phrase 'Quran dictionary arabic to urdu pdf', indicating a lure to disguise the malicious intent. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hereandyonderfm.com/uploads/1/3/0/5/130551461/130551461.html#quran+dictionary+arabic+to+urdu+pdf PDF link annotation
    • http://techbitdaily.com/uploads/1/3/0/6/130620185/pusojirasunonetid.pdfIn PDF document text
    • http://passionforartclass.com/uploads/1/3/0/4/130476144/7125856.pdfIn PDF document text
    • http://thegoldengate.net/uploads/1/3/0/3/130379082/rituwunupikolo.pdfIn PDF document text
    • http://creepyoutfitlab.com/uploads/1/3/0/6/130605078/6385359.pdfIn PDF document text
    • http://passionatepursuit.net/uploads/1/3/0/6/130604086/5196222.pdfIn PDF document text
    • http://phillipshouseinc.com/uploads/1/3/0/9/130968996/8765809.pdfIn PDF document text
    • http://exploregroupsas.com/uploads/1/3/0/8/130813883/zusumiganip.pdfIn PDF document text
    • http://thepercussiongroup.com/uploads/1/3/0/4/130436439/lawexawepivi_samasuxam.pdfIn PDF document text
    • http://myhealinghands.org.uk/uploads/1/3/0/4/130478067/bupeketukiwid.pdfIn PDF document text
    • http://www.newhopemanagement.net/uploads/1/3/0/8/130814611/fabavenevewe-zumufarinedok.pdfIn PDF document text
    • http://www.yunitravel.com/uploads/1/3/0/5/130590555/kepura.pdfIn PDF document text
    • http://stickyearth.net/uploads/1/3/0/6/130604342/3308320.pdfIn PDF document text
    • http://happyhealthyfish.pet/uploads/1/3/0/6/130604104/towavewaxif-tilozepa-zagono.pdfIn PDF document text
    • http://cvservicesonline.com/uploads/1/3/0/4/130435578/zasilabefidagozizija.pdfIn PDF document text
    • http://www.apasecretarial.co.uk/uploads/1/3/0/8/130813033/nejufakuzaliwaw.pdfIn PDF document text
    • http://nunahome.com/uploads/1/3/0/7/130775422/1050159.pdfIn PDF document text
    • http://hellomaychua.com/uploads/1/3/0/5/130589083/96664e77981.pdfIn PDF document text
    • http://nashobaspeechandfeeding.net/uploads/1/3/0/6/130621287/xuxagubega.pdfIn PDF document text
    • http://www.johnossionline.com/uploads/1/3/0/4/130435941/sofinipimenotid_sokoviwu.pdfIn PDF document text
    • http://samsungrepaircenter.net/uploads/1/3/0/2/130288926/dowagir-zudopijilele-loxudim-tegivi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0002208e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2208E 34888 bytes
SHA-256: 293d66d6906a4050cf170d64764876ff7813cacda4bbe706a3680e8231d7d1c6
font_00_sfnt_off000205ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x205CA 6896 bytes
SHA-256: 9beb7dc9aae6ed1410011b969fd07d079895c6c28fb88d98ba6641d4845a383b

Open this report in the interactive analyzer, or submit your own file for analysis.