PDF static analysis report

Static analysis result for SHA-256 ceb816c8b35d2a44…

CLEAN

PDF

92.1 KB Created: 2019-10-01 09:11:45 -03:00 Authoring application: Microsoft® Word para Office 365 First seen: 2026-05-08
MD5: 4481d9786bf15914b2d7c91feed00a0c SHA-1: a52fd98b9b2a8c0d4a122c5356a3a8d0ecbd9660 SHA-256: ceb816c8b35d2a445f8d46910ebe5742772c27c63b87f8b331b01a7b453cd9f7
4 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains embedded URLs that mimic legitimate Chilean law enforcement communications, suggesting a phishing or social engineering attempt. The URLs are designed to trick the user into downloading potentially malicious files, such as executables disguised as documents. No scripts were extracted, limiting further analysis of the payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doe.carabineros.cl/documentoDescargar.php?nombre_fisico=RVNDVURFUk8ucGRm&ruta_archivo=Li9hZGp0b3N0b3JhZ2VfMDEvMjAxOTA4L2FkajIwMTkwODA3MTIwNTA3LTE1NTY3NjEyNC5wZGY= PDF link annotation
    • http://doe.carabineros.cl/documentoDescargar.php?nombre_fisico=bGlxdWlkYWNpb24gTWF5byAyMDE5IENhYm8gMmRvLiBFc2N1ZGVyby5wZGY=&ruta_archivo=Li9hZGp0b3N0b3JhZ2VfMDEvMjAxOTA4L2FkajIwMTkwODA3MTIzMDU0LTEzNjQ2MzI4NC5wZGY=In PDF document text
    • http://doe.carabineros.cl/documentoDescargar.php?nombre_fisico=Y2FtYmlvIGd1YXJuaWNp824gIEVTQ1VFREVSTy5wZGY=&ruta_archivo=Li9hZGp0b3N0b3JhZ2VfMDEvMjAxOTA4L2FkajIwMTkwODA3MTc0MjUwLTEzMzI4MDYwSy5wZGY=In PDF document text
    • http://doe.carabineros.cl/documentoDescargar.php?nombre_fisico=Rk9STUFUTyBDQU1CSU8gR1VBUk5JQ0lPTiBFU0NVREVSTy54bHM=&ruta_archivo=Li9hZGp0b3N0b3JhZ2VfMDEvMjAxOTA4L2FkajIwMTkwODA3MTc0NDQ4LTEzMzI4MDYwSy54bHM=In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.microsoft.com/typography/fonts/In extracted file (font_00_sfnt_off00004c9e.bin)
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoftIn extracted file (font_02_sfnt_off00010191.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_02_sfnt_off00010191.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_02_sfnt_off00010191.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_02_sfnt_off00010191.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_02_sfnt_off00010191.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_02_sfnt_off00010191.bin)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C9E 38036 bytes
SHA-256: 394eaf8aa6b146c25b8e6e2b2dfb7e13f464a2949edcedd85f648067176295c5
font_01_sfnt_off0000a0a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA0A9 46828 bytes
SHA-256: 8b866099cca0ebcdfd2170e4675d6b629be087160d4b04bc2cacde51c1d5f368
font_02_sfnt_off00010191.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10191 80784 bytes
SHA-256: 828cd0032985b6cafdd34e9ec35b6b21c27721286ac945d48e8595f6e635b106

Open this report in the interactive analyzer, or submit your own file for analysis.