PDF static analysis report

Static analysis result for SHA-256 e9aa20913ce14e88…

SUSPICIOUS

PDF

298.8 KB First seen: 2019-09-30
MD5: 4216ebedd20e76cfb7d004abeefdad32 SHA-1: a44d8de6d9626c30e30d5f2969481ef4c9c4eb8f SHA-256: e9aa20913ce14e884b1c0d70cfb74cdf4ecb959d964c8cd4865c2443935f768f
26 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 4

  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.radpdf.com In PDF document text
    • https://pauisk.com/Piimx3/sharePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000006b1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6B1 9697 bytes
SHA-256: b1da5ff7d4acbab8656357aeed26780d43dc4e37fab095c097c380051cfad234
Detection
ClamAV: No threats found
Obfuscation or payload: likely
69 of 137 identifiers look randomly generated (e.g. 'YnBsaXN0MDDUAQIDBAUGs7RYJHZlcnNpb25YJG9i') — consistent with name-mangling obfuscation. Carved artifact contains 28 long base64-like blob(s).
stream_007_off00002ab1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2AB1 187484 bytes
SHA-256: c330c39d8d0d954382ac292a4b508aba0fd9d0de65c52855953ed5a62f402020
font_00_cff_off00024c75.bin pdf-font-stream PDF embedded font (cff) at offset 0x24C75 753 bytes
SHA-256: 08c9a75a51dca4baf86dbbf02b44a8d809e8d2bb40126e92adada6d6c2f7ee46
font_01_cff_off00024f75.bin pdf-font-stream PDF embedded font (cff) at offset 0x24F75 2903 bytes
SHA-256: af16b1e1fc00712994cf5e437a38be487c8a5f2aee4ef8a9ba2433bca1a2984e

Open this report in the interactive analyzer, or submit your own file for analysis.