PDF static analysis report

Static analysis result for SHA-256 d66edad8a38e3d39…

SUSPICIOUS

PDF

62.0 KB First seen: 2020-05-25
MD5: ec5430ea9546f53cf697e7842f77a11e SHA-1: 94ed2cd5f7d37db87cf38efaaab444b0e306d517 SHA-256: d66edad8a38e3d39c35a81ad5049728c356e6bbba5d333683ac4381775c73b7a
44 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a heuristic indicating it is a password-protected archive lure, suggesting it's designed to trick users into downloading a password-protected file. It also contains an embedded URI pointing to a suspicious external domain, likely for hosting the malicious archive. The document body is heavily obfuscated and truncated, preventing a more detailed analysis of its specific content, but the overall pattern strongly suggests a social engineering attack to deliver malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0117

Heuristics 3

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://hytrgfvdc.usa.cc/ooio/login/Drive_Pdf/index.php PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00001397.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1397 63940 bytes
SHA-256: 66eb01e4a3a1a6ed625a5a42fbcb4383bb8c373291e469dba113d04502c1132e

Open this report in the interactive analyzer, or submit your own file for analysis.