Malicious PDF — malware analysis report

Static analysis result for SHA-256 d60f28e6ad6723fd…

MALICIOUS

PDF

94.4 KB Created: 2023-03-21 18:36:23 +03:00 Authoring application: iTextSharp’ 5.5.10 ©2000-2016 iText Group NV (AGPL-version)
MD5: 2342ee9c7520abef3700b0fddf825c71 SHA-1: ca7f6b62ca287d031afc8cc2316bf513fbf310a6 SHA-256: d60f28e6ad6723fdb36a10077c0ed71112dc6fb74ade27ccbab0d4682ef9d452
60 Risk Score

Malware Insights

The PDF file contains a direct link to an executable payload disguised as a ZIP archive. This heuristic firing indicates a common delivery mechanism for malware. The URL http://eaglewingsuae.com/wicd/643d2215dacb3.zip is the primary indicator of compromise, suggesting the document's purpose is to lure the user into downloading and executing a malicious file.

Machine Learning

  • Nyx PDF Classifier clean score 0.0049

Heuristics 2

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eaglewingsuae.com/wicd/643d2215dacb3.zip

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_cff_off000032e4.bin
dc170c6f02f2b156352671fad65a9bda5b1469f65970b14b93d1b21cf765ef1b		 pdf-font-stream PDF embedded font (cff) at offset 0x32E4 2830 bytes
font_01_cff_off000048b8.bin
076c571119d97363b606fcb5d3bc5a3685ce58dd1fa6a8efb45d792081fd12d3		 pdf-font-stream PDF embedded font (cff) at offset 0x48B8 729 bytes
font_02_sfnt_off00005131.bin
dabca5bdd40353909ac18470e44e9982ebe51b0d3b2f342d78126ed3548b0529		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5131 5360 bytes
font_03_sfnt_off00006383.bin
f034645ad92baf4f01365910fa6acf564b8f4da4489ceb3ccaa99230a4139ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6383 7016 bytes
font_04_sfnt_off00007b61.bin
2e140c78ba7a3deff895a12e3ef243ce609aa29c91ae9b82f5f04207a22e0655		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B61 6120 bytes
font_05_sfnt_off00008fe9.bin
bcee5ba7d8cfb2e16dcee3a21900987f039f2c0243a316e3a11267d9f4248705		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FE9 7272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.