PDF static analysis report

Static analysis result for SHA-256 c571225656645c65…

SUSPICIOUS

PDF

25.9 KB Created: 2018-10-01 16:51:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2019-11-20
MD5: 3aec277ea47b96ad12cff0019128c1be SHA-1: 1e3e7c4e14835d85c50eafb5f8553f79a8cb1708 SHA-256: c571225656645c6527d4d3fff2b73e269a6f2031a6cd095ca3b111f90ebbd4c2
42 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 3

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 25 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Image-only PDF lure with a single link to a non-reputable host medium PDF_IMAGE_LURE_NONREPUTABLE_LINK
    PDF is image-heavy with little real text and its only clickable action is a single external link to a host that is not known-good. This is the canonical malspam carrier shape — a screenshot-like 'click to view' page whose sole purpose is to funnel the victim to one redirect/landing URL on a compromised or throwaway domain. Flagged suspicious rather than malicious because the link alone (no shortener / typosquat / brand path) is the only corroborator beyond the image lure.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://inatimes.co.id/1njpw1 In PDF document text
    • http://inatimes.co.id/1njpw2In PDF document text
    • http://www.monotype.comMonotypeIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bcc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BCC 10760 bytes
SHA-256: 23522e3c5d76127a0af84c947850e623b85b65778784d99ed83af56c3a1eee14
font_01_sfnt_off00004901.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4901 10824 bytes
SHA-256: 0438115e8754f407b3602a4e54973bf2fe11cfaf4eba01ef65ef13705024e524

Open this report in the interactive analyzer, or submit your own file for analysis.