PDF static analysis report

Static analysis result for SHA-256 e5ee49a683b6dde2…

SUSPICIOUS

PDF

6.53 MB Created: 2021-09-16 19:11:54 +01:00 Authoring application: Adobe InDesign 16.4 (Macintosh) (via Adobe PDF Library 16.0) First seen: 2022-07-15
MD5: 72ac938b5fa69122769b9dc67852d980 SHA-1: 67bf09429efce9b2c1a4ea1b87e722dc652bc171 SHA-256: e5ee49a683b6dde2d5435e916f60681d69fbac47ba5e6126ace405900c60c59a
40 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains heuristics indicating external URIs and a URL shortener, suggesting an attempt to redirect the user to a malicious site. The presence of an AcroForm button with an action trigger further supports this, as it can be used to execute actions like opening URLs. No scripts were extracted, but the overall structure points to a phishing or malware delivery attempt via a malicious link.

Machine Learning

  • Nyx PDF Classifier clean score 0.1679

Heuristics 5

  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.springimpact.org/contact/ PDF link annotation
    • http://ns.camerabits.com/photomechanic/1.0/In PDF document text
    • http://ns.fotoware.com/iptcxmp-legacy/1.0/In PDF document text
    • http://ns.fotoware.com/iptcxmp-reserved/1.0/In PDF document text
    • http://ns.iview-multimedia.com/mediapro/1.0/In PDF document text
    • http://cipa.jp/exif/1.0/In PDF document text
    • http://ns.useplus.org/ldf/xmp/1.0/In PDF document text
    • https://www.springimpact.org/2021/09/journey-to-impactIn PDF document text
    • https://www.springimpact.org/journey-to-impactIn PDF document text
    • https://www.springimpact.org/newsletter/?utm_source=Report&utm_medium=CTA&utm_campaign=Journey_to_impactIn PDF document text
    • https://www.springimpact.org/?utm_source=Report&utm_medium=CTA&utm_campaign=Journey_to_impactIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://iptc.org/std/Iptc4xmpExt/2008-02-29/In PDF document text
    • http://ns.microsoft.com/photo/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xmp/InDesign/privateIn PDF document text
    • https://bit.ly/SpringImpactLinkedInIn PDF document text
    • https://bit.ly/SpringImpactTwitterIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off0000190b.icc pdf-icc-profile PDF ICC profile at offset 0x190B 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00003b0d.bin pdf-font-stream PDF embedded font (cff) at offset 0x3B0D 4065 bytes
SHA-256: 9f9b5d2fb2f67aa47a61c9fa586ff0ae0aebddeb708bef851e5ed08762481bf3
font_01_cff_off0000495a.bin pdf-font-stream PDF embedded font (cff) at offset 0x495A 5190 bytes
SHA-256: 76d67066a01d65291b7b67c68a855f50d4952a695de451ec3b0e0738a35fd92d
font_02_cff_off00121bea.bin pdf-font-stream PDF embedded font (cff) at offset 0x121BEA 1964 bytes
SHA-256: 8e80540a97bf0c243e3ac19bcfce7cd1e228e41b8e5fb0a6ea74a75e3aca9ead
font_03_sfnt_off0064d836.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64D836 10905 bytes
SHA-256: 444c210af12243557deb79e4f9c4b8d1a3e142f059f6bdfff25fd6a9167ff3cf

Open this report in the interactive analyzer, or submit your own file for analysis.