PDF static analysis report

Static analysis result for SHA-256 c70830bcf8175caa…

SUSPICIOUS

PDF

155.0 KB Created: 2017-11-30 06:27:13 -05:00 Authoring application: 376377000P000D000F000C000r000e000a000t000o000r000 0002000.0004000.0001000.00010003 First seen: 2026-05-04
MD5: 6b670f3c14748919413ba1873ff16b04 SHA-1: 96d5311613a5a5e5f43c85d82da1678130a72a6c SHA-256: c70830bcf8175caa5dac17c2c2fb87b80520ca33aedaf46aa6bc8fd579225a68
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The primary heuristic firing, SE_ADVANCE_FEE_SCAM_LURE, strongly indicates the document's intent is to defraud the user through a fake lottery or prize scheme. The embedded URLs are confirmed benign and do not provide further indicators. No scripts were extracted from this sample. The document body was heavily truncated and unreadable, preventing a more detailed analysis of the lure's specifics.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
🗂 Part of campaign: shared payload a2ec24f89a 4 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off0001e736.bin pdf-font-stream PDF embedded font (cff) at offset 0x1E736 227 bytes
SHA-256: a2ec24f89aad35d0a61fe14f28c609fe1950faa01659450987a62dc4e0283aa4
font_01_sfnt_off0001e84c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E84C 14428 bytes
SHA-256: c4f4bd04470f81c7138469023b81ff3126fd662a812f707552b5f0501296999b
font_02_cff_off00020836.bin pdf-font-stream PDF embedded font (cff) at offset 0x20836 1639 bytes
SHA-256: 274318fb4fccd234c702a7718cef39d77f22accfe596457c985bff53126ea769
font_03_cff_off000248f3.bin pdf-font-stream PDF embedded font (cff) at offset 0x248F3 2292 bytes
SHA-256: ed09837b448359fde04f977655618fba7d534a58c1609fa2059d698e350d9364
font_04_cff_off0002519a.bin pdf-font-stream PDF embedded font (cff) at offset 0x2519A 3707 bytes
SHA-256: 8ff7dc707e883e058e04dc9fb7a4ef7294fd7550d26b00aecefa4b29eccdb42d

Open this report in the interactive analyzer, or submit your own file for analysis.