PDF static analysis report

Static analysis result for SHA-256 dc7cd1776face02d…

CLEAN

PDF

3.17 MB Created: 2012-09-26 13:45:13 +07:00 Authoring application: Microsoft® Word 2010 First seen: 2018-06-21
MD5: e939c19b7b9cf946dd9dddc7229bbe81 SHA-1: 4ea68166991f0c70140b976920598772e05d09e6 SHA-256: dc7cd1776face02d457e382528d27fd25370f3f149fe2db28754a8f14a048623
6 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a heuristic indicating a relation to CVE-2023-26369, a known vulnerability in Adobe Reader and Acrobat related to handling TrueType fonts. The file also contains an external URI pointing to 'http://www.spds.ru/download/ppr/ppr-2.html', which is likely the malicious landing page. No scripts were extracted from this sample, but the presence of the CVE and the external link strongly suggests an exploit attempt to redirect the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.spds.ru/download/ppr/ppr-2.html PDF link annotation
    • http://www.disc-tools.com/download/daemonIn PDF document text
    • http://www.microsoft.com/ru-ru/download/details.aspx?id=6149In PDF document text
    • http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-In PDF document text
    • http://www.microsoft.com/ru-ru/download/details.aspx?id=5897In PDF document text
    • http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&displaylang=enIn PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/tspca.crt0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comYouIn PDF document text
    • http://www.microsoft.com/typography/0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_029_off0028ba9e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x28BA9E 215980 bytes
SHA-256: 05a1a57a03067ebac74b2644f80db32b3eb4b725c9421e9e3d152cebaf6e6086
stream_031_off002be92b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2BE92B 225272 bytes
SHA-256: 21158b6d0921e6ab950438ebaf7c44f15fec025690c0bd054017e038288521d3
stream_032_off002d97a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2D97A5 188800 bytes
SHA-256: 2902b16c43aa0c248a18b391f2526235e64486455edda9afcfe6e07d8935104d

Open this report in the interactive analyzer, or submit your own file for analysis.