Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccc5e0c9e5b31c4d…

MALICIOUS

PDF

92.7 KB Created: 2023-03-21 18:36:23 +03:00 Authoring application: iTextSharp’ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)
MD5: a29c97ea41ca0b777ca3b004bd671583 SHA-1: dc193e1a35118cf42e6f6c1006f5df08c570eb00 SHA-256: ccc5e0c9e5b31c4d09331832fca9829f3f7d9bf761f3fea7fe49fdb94aa6ac17
62 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The PDF file contains a direct link to a ZIP archive hosted on 'garrisonsloan.com'. This heuristic firing indicates the document is designed to prompt the user to download a potentially malicious payload. The presence of the URL in the document body further supports this conclusion. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0167

Heuristics 3

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garrisonsloan.com/blo/6436987081eb4.zip
    • https://www.adobe.com

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off000034f8.bin
dc170c6f02f2b156352671fad65a9bda5b1469f65970b14b93d1b21cf765ef1b		 pdf-font-stream PDF embedded font (cff) at offset 0x34F8 2830 bytes
font_01_sfnt_off00004a69.bin
dabca5bdd40353909ac18470e44e9982ebe51b0d3b2f342d78126ed3548b0529		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A69 5360 bytes
font_02_sfnt_off00005cbb.bin
f034645ad92baf4f01365910fa6acf564b8f4da4489ceb3ccaa99230a4139ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CBB 7016 bytes
font_03_sfnt_off00007499.bin
2e140c78ba7a3deff895a12e3ef243ce609aa29c91ae9b82f5f04207a22e0655		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7499 6120 bytes
font_04_sfnt_off00008921.bin
bcee5ba7d8cfb2e16dcee3a21900987f039f2c0243a316e3a11267d9f4248705		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8921 7272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.