Malicious PDF — malware analysis report

Static analysis result for SHA-256 d392c0c3ef37da23…

MALICIOUS

PDF

4.98 MB First seen: 2019-06-27
MD5: 8e5a6ca214d1df87e1e03c024073ad87 SHA-1: 7f787bed34d8d954d6178162634cccfd533142cc SHA-256: d392c0c3ef37da23f9c9fc5efbf44a6e27e8aca057b9fbe65d338315840c9536
312 Risk Score

Malware Insights

MITRE ATT&CK
T1059 Command and Scripting Interpreter T1539 Steal or Harvest Data T1078 Valid Accounts

The PDF contains an embedded script payload and multiple heuristics indicate malicious intent. Specifically, the document lures the user with urgency and requests for MFA codes or recovery secrets, which are high-risk lures. It also contains instructions for executing commands via LOLBins. The embedded script and the nature of the lures suggest an attempt to harvest credentials or session tokens.

Machine Learning

  • Nyx PDF Classifier clean score 0.0246

Heuristics 11

  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.counterhack.net/permission_memo.html In PDF document text
    • https://portal.azureIn PDF document text
    • https://github.com/gentilkiwi/mimikatz/In PDF document text
    • https://github.com/PowerShellMafia/PowerSploit/In PDF document text
    • https://github.com/vanhauser-thc/In PDF document text
    • https://github.com/gentilkiwi/mimikatz/wiki/In PDF document text
    • http://blog.cobaltstrike.com/In PDF document text
    • https://cobaltstrike.com/help-browser-pivotingIn PDF document text
    • https://www.microsoftIn PDF document text
    • https://github.com/azure/In PDF document text
    • https://blogs.msdn.microsoftIn PDF document text
    • http://gauravmantri.com/2012/09/14/about-windows-azure-publishIn PDF document text
    • https://azure.microsoftIn PDF document text
    • https://github.com/Azure/azure-powershell/In PDF document text
    • https://docs.microsoftIn PDF document text
    • https://storagerm.blob.coreIn PDF document text
    • https://storeasm.queue.core.windows.net/testqueueIn PDF document text
    • http://www.oxid.it/cain.htmlIn PDF document text
    • https://github.com/In PDF document text
    • http://www.mitec.cz/wrr.htmlIn PDF document text
    • https://www.chiark.greenendIn PDF document text
    • http://www.freerdpIn PDF document text
    • https://name.servicebus.windows.net:443/In PDF document text
    • https://github.com/paolosalvatori/In PDF document text
    • https://lccn.loc.gov/2017051237In PDF document text
    • https://nostarch.com/azure/In PDF document text
    • https://portal.msrc.microsoft.com/en-us/PDF link annotation
    • https://portal.msrc.microsoft.com/en-us/engage/pentest#pentesttermsIn PDF document text
    • https://manage.windowsazure.com/In PDF document text
    • https://docs.microsoft.com/en-us/azure/In PDF document text
    • https://technet.microsoft.com/en-us/itpro/windows/In PDF document text
    • https://www.thc.org/thc-hydra/In PDF document text
    • https://docs.microsoft.com/en-us/In PDF document text
    • https://docs.microsoft.com/en-us/azure/active-directory/In PDF document text
    • https://blogs.msdn.microsoft.com/powershell/2015/06/09/In PDF document text
    • http://portal.azure.com/In PDF document text
    • https://msdn.microsoft.com/en-us/library/windows/In PDF document text
    • https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/In PDF document text
    • https://docs.microsoft.com/en-us/azure/virtual-machines/virtual-machinesIn PDF document text
    • https://www.shodan.io/In PDF document text
    • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threatIn PDF document text
    • https://docs.microsoft.com/en-us/azure/storage/In PDF document text
    • https://lasec.epfl.ch/In PDF document text
    • https://nmap.org/In PDF document text
    • https://nmap.orgIn PDF document text
    • https://nmap.org/submit/In PDF document text
    • https://docs.microsoft.com/en-us/azure/best-practices-network-security/In PDF document text
    • https://docs.microsoft.com/en-us/azure/��security/In PDF document text
    • https://docs.microsoft.com/en-us/azure/service-bus-messaging/In PDF document text
    • https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault/In PDF document text
    +28 more URL(s)

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00104851.bin pdf-embedded-script PDF decompressed stream script payload at offset 0x104851 9489 bytes
SHA-256: 748aa82b1245413bef2e19b9ccc2ea2387314c878e9b862b0d839aaa4cb1b9cc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 5 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
BT
/CS0 cs 0 0 0  scn
/GS0 gs
/T1_0 1 Tf
0.034 Tc -0.034 Tw 9 0 0 9 49.5 24 Tm
[(xi)-12.2(i)]TJ
/T1_1 1 Tf
0 Tc 0 Tw /Span<</ActualText<FEFF00A000A000A0>>> BDC 
8.5 0 0 8.5 58.6125 24 Tm
(   )Tj
EMC 
/T1_2 1 Tf
0.025 Tc 6 0 0 6 71.3625 24 Tm
[(C)-11(o)-16.7(n)-6.4(t)-15.4(e)-14.1(n)-6.4(t)-17(s i)1.3(n D)-23.4(e)-11.5(t)-15.4(a)-0.8(i)0.5(l)]TJ
/T1_3 1 Tf
0 Tc 9 0 0 9 49.5 622.9549 Tm
(Encountering Two-Factor Authentication)Tj
0.308 Tc -0.121 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..................................)Tj
0 Tc 0 Tw 38.768 0 Td
(26)Tj
-34.768 -1.222 Td
(Using Certificate Authentication)Tj
0.308 Tc -0.108 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.................................)Tj
0 Tc 0 Tw 34.768 0 Td
(28)Tj
-34.768 -1.222 Td
(Using a Service Principal or a Service Account)Tj
0.308 Tc -0.308 Tw 20.332 0 Td
(.......................)Tj
0 Tc 0 Tw 14.436 0 Td
(28)Tj
-34.768 -1.222 Td
(Accessing Cookies)Tj
0.308 Tc -0.125 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(28)Tj
-34.768 -1.222 Td
(Proxying Traffic Through the User\222s Browser)Tj
0.308 Tc -0.308 Tw 19.1 0 Td
(.........................)Tj
0 Tc 0 Tw 15.668 0 Td
(29)Tj
-34.768 -1.222 Td
(Utilizing Smartcards)Tj
0.308 Tc -0.088 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(30)Tj
-34.768 -1.222 Td
(Stealing a Phone or Phone Number)Tj
0.308 Tc -0.308 Tw 15.404 0 Td
(...............................)Tj
0 Tc 0 Tw 19.364 0 Td
(31)Tj
-34.768 -1.222 Td
(Prompting the User for 2FA)Tj
0.308 Tc -0.068 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(....................................)Tj
0 Tc 0 Tw 34.768 0 Td
(32)Tj
-38.768 -1.222 Td
(Summary)Tj
0.308 Tc -0.013 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................................................)Tj
0 Tc 0 Tw 38.768 0 Td
(33)Tj
/T1_4 1 Tf
10 0 0 10 49.5 510.9549 Tm
(3)Tj
( )Tj
0.01 Tc 24.374 Tw /Span<</ActualText<FEFF0052>>> BDC 
0 -1.2 TD
(R)Tj
EMC 
(ECONN)Tj
/Span<</ActualText<FEFF00610069007300730061>>> BDC 
(AISSA)Tj
EMC 
(NCE)Tj
/Span<</ActualText<FEFF0009>>> BDC 
( )Tj
EMC 
(35)Tj
/T1_3 1 Tf
0 Tc 0 Tw 9 0 0 9 49.5 483.9549 Tm
(Installing PowerShell and the Azure PowerShell Module)Tj
0.308 Tc -0.263 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................)Tj
0 Tc 0 Tw 38.768 0 Td
(36)Tj
-34.768 -1.222 Td
(On Windows)Tj
0.308 Tc -0.308 Tw 6.164 0 Td
(..............................................)Tj
0 Tc 0 Tw 28.604 0 Td
(36)Tj
-34.768 -1.222 Td
(On Linux or macOS)Tj
0.308 Tc -0.308 Tw (..........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(36)Tj
-34.768 -1.222 Td
(Running Your Tools)Tj
0.308 Tc -0.306 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(37)Tj
-38.768 -1.222 Td
(Service Models)Tj
0.308 Tc -0.153 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...................................................)Tj
0 Tc 0 Tw 38.768 0 Td
(38)Tj
-38.768 -1.222 Td
(Best Practices: PowerShell Security)Tj
0.308 Tc -0.308 Tw 15.092 0 Td
(......................................)Tj
0 Tc 0 Tw 23.676 0 Td
(39)Tj
-38.768 -1.222 Td
(Authenticating with the PowerShell Module and CLI)Tj
0.308 Tc -0.293 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..........................)Tj
0 Tc 0 Tw 38.768 0 Td
(40)Tj
-38.768 -1.222 Td
(Authenticating with Management Certificates)Tj
0.308 Tc -0.053 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..............................)Tj
0 Tc 0 Tw 38.768 0 Td
(40)Tj
-34.768 -1.222 Td
(Installing the Certificate)Tj
0.308 Tc -0.271 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................................)Tj
0 Tc 0 Tw 34.768 0 Td
(41)Tj
-34.768 -1.222 Td
(Authenticating)Tj
0.308 Tc -0.027 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.............................................)Tj
0 Tc 0 Tw 34.768 0 Td
(41)Tj
-34.768 -1.222 Td
(Connecting and Validating Access)Tj
0.308 Tc -0.18 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...............................)Tj
0 Tc 0 Tw 34.768 0 Td
(42)Tj
-38.768 -1.222 Td
(Best Practices: Service Principals)Tj
0.308 Tc -0.164 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................................)Tj
0 Tc 0 Tw 38.768 0 Td
(43)Tj
-38.768 -1.222 Td
(Authenticating with Service Principals)Tj
0.308 Tc -0.308 Tw 16.324 0 Td
(....................................)Tj
0 Tc 0 Tw 22.444 0 Td
(44)Tj
-34.768 -1.222 Td
(Using Service Principals with Passwords)Tj
0.308 Tc -0.014 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...........................)Tj
0 Tc 0 Tw 34.768 0 Td
(44)Tj
-34.768 -1.222 Td
(Authenticating with X)Tj
/Span<</ActualText<FEFF002E>>> BDC 
(.)Tj
EMC 
(509 Certificates)Tj
0.308 Tc -0.308 Tw 16.636 0 Td
(.............................)Tj
0 Tc 0 Tw 18.132 0 Td
(45)Tj
-38.768 -1.222 Td
(Best Practices: Subscription Security)Tj
0.308 Tc -0.308 Tw 15.708 0 Td
(.....................................)Tj
0 Tc 0 Tw 23.06 0 Td
(46)Tj
-38.768 -1.222 Td
(Gathering Subscription Information)Tj
0.308 Tc -0.077 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.....................................)Tj
0 Tc 0 Tw 38.768 0 Td
(47)Tj
-34.768 -1.222 Td
(Viewing Resource Groups)Tj
0.308 Tc -0.128 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.....................................)Tj
0 Tc 0 Tw 34.768 0 Td
(49)Tj
-34.768 -1.222 Td
(Viewing a Subscription\222s App Services \(Web Apps\))Tj
0.308 Tc -0.155 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...................)Tj
0 Tc 0 Tw 34.768 0 Td
(50)Tj
-34.768 -1.222 Td
(Gathering Information on Virtual Machines)Tj
0.308 Tc -0.064 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.........................)Tj
0 Tc 0 Tw 34.768 0 Td
(51)Tj
-34.768 -1.222 Td
(Finding Storage Accounts and Storage Account Keys)Tj
0.308 Tc -0.105 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..................)Tj
0 Tc 0 Tw 34.768 0 Td
(54)Tj
-38.768 -1.222 Td
(Gathering Information on Networking)Tj
0.308 Tc -0.044 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...................................)Tj
0 Tc 0 Tw 38.768 0 Td
(56)Tj
-34.768 -1.222 Td
(Network Interfaces)Tj
0.308 Tc -0.122 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(56)Tj
-34.768 -1.222 Td
(Obtaining Firewall Rules or Network Security Groups)Tj
0.308 Tc -0.275 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..................)Tj
0 Tc 0 Tw 34.768 0 Td
(59)Tj
-34.768 -1.222 Td
(Viewing Azure SQL Databases and Servers)Tj
0.308 Tc -0.308 Tw 19.1 0 Td
(.........................)Tj
0 Tc 0 Tw 15.668 0 Td
(61)Tj
-38.768 -1.222 Td
(Consolidated PowerShell Scripts)Tj
0.308 Tc -0.09 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................................)Tj
0 Tc 0 Tw 38.768 0 Td
(63)Tj
-34.768 -1.222 Td
(ASM Script)Tj
0.308 Tc -0.308 Tw 4.932 0 Td
(................................................)Tj
0 Tc 0 Tw 29.836 0 Td
(64)Tj
-34.768 -1.222 Td
(ARM Script)Tj
0.308 Tc -0.308 Tw 4.932 0 Td
(................................................)Tj
0 Tc 0 Tw 29.836 0 Td
(66)Tj
-38.768 -1.222 Td
(Summary)Tj
0.308 Tc -0.013 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.......................................................)Tj
0 Tc 0 Tw 38.768 0 Td
(68)Tj
/T1_4 1 Tf
10 0 0 10 49.5 151.9549 Tm
(4)Tj
( )Tj
0.01 Tc /Span<</ActualText<FEFF0045>>> BDC 
T*
(E)Tj
EMC 
(X)Tj
/Span<</ActualText<FEFF0061006D0069>>> BDC 
(AMI)Tj
EMC 
(N)Tj
/Span<</ActualText<FEFF0069>>> BDC 
(I)Tj
EMC 
(NG S)Tj
/Span<</ActualText<FEFF0074>>> BDC 
(T)Tj
EMC 
(OR)Tj
/Span<</ActualText<FEFF0061>>> BDC 
(A)Tj
EMC 
(GE)Tj
/Span<</ActualText<FEFF0009>>> BDC 
( )Tj
EMC 
34.618 0 Td
(69)Tj
/T1_3 1 Tf
0 Tc 9 0 0 9 49.5 124.9549 Tm
(Best Practices: Storage Security)Tj
0.308 Tc -0.274 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(........................................)Tj
0 Tc 0 Tw 38.768 0 Td
(70)Tj
-38.768 -1.222 Td
(Accessing Storage Accounts)Tj
0.308 Tc -0.206 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(..........................................)Tj
0 Tc 0 Tw 38.768 0 Td
(71)Tj
-34.768 -1.222 Td
(Storage Account Keys)Tj
0.308 Tc -0.264 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(........................................)Tj
0 Tc 0 Tw 34.768 0 Td
(71)Tj
-34.768 -1.222 Td
(User Credentials)Tj
0.308 Tc -0.308 Tw 7.396 0 Td
(............................................)Tj
0 Tc 0 Tw 27.372 0 Td
(71)Tj
-34.768 -1.222 Td
(SAS Tokens)Tj
0.308 Tc -0.141 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...............................................)Tj
0 Tc 0 Tw 34.768 0 Td
(72)Tj
-38.768 -1.222 Td
(Where to Find Storage Credentials)Tj
0.308 Tc -0.051 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(.....................................)Tj
0 Tc 0 Tw 38.768 0 Td
(73)Tj
-34.768 -1.222 Td
(Finding Keys in Source Code)Tj
0.308 Tc -0.278 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...................................)Tj
0 Tc 0 Tw 34.768 0 Td
(73)Tj
-34.768 -1.222 Td
(Obtaining Keys from a Developer\222s Storage Utilities)Tj
0.308 Tc -0.182 Tw /Span<</ActualText<FEFF0020002E>>> BDC 
( )Tj
EMC 
(...................)Tj
0 Tc 0 Tw 34.768 0 Td
(73)Tj
ET
font_00_cff_off000db952.bin pdf-font-stream PDF embedded font (cff) at offset 0xDB952 1718 bytes
SHA-256: af9afcd67e9eeb4430844c40b2fa711ab53bab642aab5b89dca83f873590e2f1
font_01_cff_off000dbfeb.bin pdf-font-stream PDF embedded font (cff) at offset 0xDBFEB 4511 bytes
SHA-256: 0b448e2ad9f1991caf076f8cde59a43db33ef0fdf16c861b8160dd7d11d1410e
font_02_cff_off000dcea6.bin pdf-font-stream PDF embedded font (cff) at offset 0xDCEA6 5008 bytes
SHA-256: ba51813b161ab6038fceee7c56ac2430bdd013fbd798b770aff0a8d56d4df830
font_03_cff_off000ddec5.bin pdf-font-stream PDF embedded font (cff) at offset 0xDDEC5 789 bytes
SHA-256: 4a31bb567ef785b648df2524b626d7d3cea2de5af57591011691ee2a7ace80b6
font_04_cff_off000e43a1.bin pdf-font-stream PDF embedded font (cff) at offset 0xE43A1 2420 bytes
SHA-256: edb4558428130c26a55aed01397a356e04f663a42f1644318c803ecd52dbd439
font_05_cff_off000e4bfa.bin pdf-font-stream PDF embedded font (cff) at offset 0xE4BFA 2859 bytes
SHA-256: f2ad6280b5dfd6b74a31e29bce798db6e46fe7bdb31706ece9041ae38a1c0739
font_06_cff_off000eb664.bin pdf-font-stream PDF embedded font (cff) at offset 0xEB664 1749 bytes
SHA-256: 4fedc625ffcc901ca59f08c5a93f168246feea85ef2d8b4056f721d513ce35bf
font_07_cff_off000ebcbd.bin pdf-font-stream PDF embedded font (cff) at offset 0xEBCBD 5123 bytes
SHA-256: 4a58fcc12cafbee1e8fe6e1135a6dd551f59c6966864984367d5c80589052236
font_08_cff_off000ecd56.bin pdf-font-stream PDF embedded font (cff) at offset 0xECD56 2161 bytes
SHA-256: 41c036018e5f03fd9d346f9bed6d11607799cc29b026fb413368a06b3878beca
font_09_cff_off0012af59.bin pdf-font-stream PDF embedded font (cff) at offset 0x12AF59 414 bytes
SHA-256: 6e10ccabf7ba6588816609200d1056bcf043e037b8ddff73ba8d3bcff3c9b4b9
font_10_cff_off0017dce6.bin pdf-font-stream PDF embedded font (cff) at offset 0x17DCE6 1236 bytes
SHA-256: 08e52b42953a9c3e12230c8e3398ea7fb596884d40addd6568843f0482564a79
font_11_cff_off003f9784.bin pdf-font-stream PDF embedded font (cff) at offset 0x3F9784 966 bytes
SHA-256: 8b8bb61925c499491cf6b7dd59fcc6ed82064372bc97c603c78f6d423889733a
font_12_cff_off0047d8ba.bin pdf-font-stream PDF embedded font (cff) at offset 0x47D8BA 3212 bytes
SHA-256: ce2dfc60d30133a89f75c1066f3a5b8e3f5f55b7233af5548f0e4dbdbd89509f
font_13_cff_off0047e5cd.bin pdf-font-stream PDF embedded font (cff) at offset 0x47E5CD 440 bytes
SHA-256: bcb845c9394c41f01cd0c0527e489250f3ebd05d0a41844a97b7b8a40d82a0f3
font_14_cff_off0047e8d3.bin pdf-font-stream PDF embedded font (cff) at offset 0x47E8D3 488 bytes
SHA-256: e0ec761cef7d2a18c6de378ff3112321dbe06968258f06646e29aba1318d29b2
font_15_cff_off0047ec25.bin pdf-font-stream PDF embedded font (cff) at offset 0x47EC25 1197 bytes
SHA-256: de1d0fd38ef49680c3f97a59d36960017fc80d1bd723547af77fa966ff569b34
font_16_cff_off004a272d.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A272D 4533 bytes
SHA-256: fc2a68606e7770450af7cf51a8a4aee4897919f9fdeb14cd18761381c0955283
font_17_cff_off004a382d.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A382D 10628 bytes
SHA-256: 22f4b403c583f4d83a2e3fc004b3916553e62ae8f497c68964affd24d8462415
font_18_cff_off004a5b08.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A5B08 2916 bytes
SHA-256: dd8848ab66c9ade9cc1f091d6f91da40bbba6f1f107deb3c4ff5828cf44de27d
font_19_cff_off004a64e6.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A64E6 3016 bytes
SHA-256: 414cb072427e203c93d71b59fa6e09ca5c061bdc77834e4d58367da6cb0d5724
font_20_cff_off004a6e42.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A6E42 6077 bytes
SHA-256: 78803c16d9c6bb0b99bda72674aac381f63cfd039d8106351c1c9ce1b69055e1
font_21_cff_off004a83e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x4A83E2 11203 bytes
SHA-256: 356a99c5c134d8618c53ef58efd4148b5a9ab7e8efe2d5f26feda1892f8886e4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.42, consistent with packed or encrypted content.
font_22_cff_off004ab14d.bin pdf-font-stream PDF embedded font (cff) at offset 0x4AB14D 3423 bytes
SHA-256: 43c7e49409ae526f05bb0f963dbb0a04e23e698146890e64db9617c825561038
font_23_cff_off004abf9b.bin pdf-font-stream PDF embedded font (cff) at offset 0x4ABF9B 4435 bytes
SHA-256: 74ad099ea135dd32602247b5aeead46d1f0721638dbba4c0d25e8668bed8f5f5
font_24_cff_off004d927e.bin pdf-font-stream PDF embedded font (cff) at offset 0x4D927E 7960 bytes
SHA-256: 8bfe6ddced6fa88016c1040293345f1586c07f0f678c3432ab26c15e9005d231
font_25_cff_off004dbdb8.bin pdf-font-stream PDF embedded font (cff) at offset 0x4DBDB8 4939 bytes
SHA-256: 37249032dbe1c2d486b7c8da30deacc1c0c8ee761529db7363ce349f719ec44e
font_26_cff_off004df9fb.bin pdf-font-stream PDF embedded font (cff) at offset 0x4DF9FB 4294 bytes
SHA-256: ad200b7aa8c5dc789b33ad9911f2f3349877a590ededa36917e5ad294a3bac75
font_27_cff_off004e0b00.bin pdf-font-stream PDF embedded font (cff) at offset 0x4E0B00 5451 bytes
SHA-256: ed4c5cbb66f37cb80aaee174375082b27a493768370374b16d35d7aae15bcff6
font_28_cff_off004e1eb2.bin pdf-font-stream PDF embedded font (cff) at offset 0x4E1EB2 3636 bytes
SHA-256: e5bc0a2154b3a46424f7216ba63837ac4683eb3919302c2e356c85e7f748ff22
font_29_cff_off004e2ba9.bin pdf-font-stream PDF embedded font (cff) at offset 0x4E2BA9 835 bytes
SHA-256: 3641a805d2f31c3b63f847f997a3d05e21bbb3f206df6fe73362e2595c51eab5
font_30_cff_off004eb13c.bin pdf-font-stream PDF embedded font (cff) at offset 0x4EB13C 5525 bytes
SHA-256: a0b7b1e9cc06b651d09067cb689ceb9cfc5d23384fd7b26e97075c43e682a460