PDF static analysis report

Static analysis result for SHA-256 ee510817e684d711…

CLEAN

PDF

5.80 MB Created: 2018-08-10 00:54:28 -03:00 Authoring application: Sejda 3.2.56 (www.sejda.org) (via 3-Heights(TM) PDF Optimization Shell 4.8.25.2 (http://www.pdf-tools.com)) First seen: 2020-09-15
MD5: 065bf47ba29861e19151902d3c92dea6 SHA-1: 3abb053e6aa6dd64714b699faefc8048fa043d10 SHA-256: ee510817e684d711beb24e2d2ced5aa4c762d5e63b73568e3322e9ca544797d0
24 Risk Score

Malware Insights

MITRE ATT&CK
T1566.003 Spearphishing Attachment

The PDF document exhibits characteristics of an advance-fee scam, using language related to lotteries, beneficiaries, prizes, and parcel delivery requirements. The high stream count suggests obfuscation techniques were employed. Several external URLs were extracted, with some flagged as unknown or confirmed benign, but the primary lure is evident in the document's structure and heuristic firings.

Machine Learning

  • Nyx PDF Classifier clean score 0.2432

Heuristics 3

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.gtexportal.org/home/ PDF link annotation
    • http://www.regulomedb.org/In PDF document text
    • http://www2.inca.gov.br/wps/wcm/connect/tiposdecancer/site/home/colo_utero/definicIn PDF document text
    • http://www.inca.gov.br/conteudo_view.asp?id=322In PDF document text
    • https://www.qiagenbioinformatics.com/In PDF document text
    • http://www.tabnet.datasus.gov.br/In PDF document text
    • http://www.ufsj.edu.br/recgenlabIn PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/28012700In PDF document text
    • http://www.ncbi.nlm.nih.gov/pubmed/?term=de%20Sousa%20SF%5BAuthor%5D&cauthor=true&cauthor_uid=26979257In PDF document text
    • http://www.ncbi.nlm.nih.gov/pubmed/16908634In PDF document text
    • http://www.ncbi.nlm.nih.gov/pubmed/20074974In PDF document text
    • http://www.nature.com/doifinder/10.1038/nrc.2018.13In PDF document text
    • http://www.rstudio.com/In PDF document text
    • http://www.who.int/selection_medicines/committees/expert/20/applications/Retinoblastoma.pdfIn PDF document text
    • http://www.scielo.br/scielo.php?script=sci_arttext&nrm=iso&lng=pt&tlng=pt&pid=S0074-In PDF document text
    • https://www.ncbi.nlm.nih.gov/sra/SRX3350440In PDF document text
    • https://doi.org/10.6084/m9.figshare.5661802In PDF document text
    • https://www.ncbi.nlm.nih.gov/sra/SRX3427716In PDF document text
    • https://doi.org/10.6084/m9.figshare.5661988In PDF document text
    • http://www.nature.com/articles/s41598-018-26623-xIn PDF document text
    • https://www.nature.com/articles/s41598-018-26623-xIn PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Beckenkamp%20A%5BAuthor%5D&cauthor=true&cauthor_uid=26943912In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Davies%20S%5BAuthor%5D&cauthor=true&cauthor_uid=26943912In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Willig%20JB%5BAuthor%5D&cauthor=true&cauthor_uid=26943912In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Buffon%20A%5BAuthor%5D&cauthor=true&cauthor_uid=26943912In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=CD26%2FDPPIV+in+cancer+progression+and+spreadIn PDF document text
    • https://www.nature.com/articles/nrm2822#auth-2In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Rodrigues%20V%5BAuthor%5D&cauthor=true&cauthor_uid=22168464In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Cordeiro-da-Silva%20A%5BAuthor%5D&cauthor=true&cauthor_uid=22168464In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Laforge%20M%5BAuthor%5D&cauthor=true&cauthor_uid=22168464In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Ouaissi%20A%5BAuthor%5D&cauthor=true&cauthor_uid=22168464In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Silvestre%20R%5BAuthor%5D&cauthor=true&cauthor_uid=22168464In PDF document text
    • https://en.wikipedia.org/wiki/Locus_In PDF document text
    • https://en.wikipedia.org/wiki/Gene_expressionIn PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/26555224In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/?term=Kruglyak%20L%5BAuthor%5D&cauthor=true&cauthor_uid=17047685In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/22955616In PDF document text
    • https://www.ncbi.nlm.nih.gov/pubmed/20368146In PDF document text
    • https://www.youtube.com/watch?v=lQBMWRdMFl8In PDF document text
    • http://www.pdf-tools.comIn PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off00012d73.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12D73 1540700 bytes
SHA-256: 55c477317b5179a577aa936bf59e5a2ac5203f0b27c4607be9ffb6441aacd3c7
stream_038_off0005dafa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5DAFA 1540700 bytes
SHA-256: 1a082fafe5d420c8123947d718731ef97e5e6f9ca8c8606a6a54a9354cdb83ee
stream_095_off000d30b9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD30B9 6996 bytes
SHA-256: 9ee832a866ddb8e791e080981656e43d7b60f55faa145271006eba0164f0caeb
stream_128_off00105b4f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x105B4F 1540700 bytes
SHA-256: 3404a1c8a10a75fd89c92e85cd159ee542b3dcc4e5aed977e717ebaada852419
stream_174_off00167186.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x167186 1540700 bytes
SHA-256: 2665e4d1c405bad0908ddb9079cfca826b40fbd334191b06f701a5c6c3c0a214
stream_188_off003f040a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3F040A 34976 bytes
SHA-256: cf0cca37386fae8d5db1e5a41da74a9013a7ce69b87c336402250d2f12a07a3f
stream_189_off003fa735.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3FA735 79036 bytes
SHA-256: abf15c7c1541d3be526b3c94a7e2e6dea43f40597094d9fc0d9209d09b3d078a
stream_199_off004b4dc6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B4DC6 60032 bytes
SHA-256: e39be6616f859283bdb3ef9e337a3d9615729bd1e10a428efbe20d04bd136ea5
icc_00_off00011d28.icc pdf-icc-profile PDF ICC profile at offset 0x11D28 912 bytes
SHA-256: 9e3d49aef74009b18086d1e48762b016f156a1d63e3eafb174452a2f22ba2095
icc_05_off002beee9.icc pdf-icc-profile PDF ICC profile at offset 0x2BEEE9 416 bytes
SHA-256: 0976fe7bc0f118a47c89747cb707c6f76044b48baf670dad811d0514bc2c4214
icc_06_off002bf033.icc pdf-icc-profile PDF ICC profile at offset 0x2BF033 2576 bytes
SHA-256: 942e0f66212eb8ad252706559da5007d893d7350652704f8d115d5e6074479d0
icc_08_off00351698.icc pdf-icc-profile PDF ICC profile at offset 0x351698 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
icc_11_off00423cd3.icc pdf-icc-profile PDF ICC profile at offset 0x423CD3 557168 bytes
SHA-256: 35f401731df11a4eba3502af632e51d68bc394bcb7d34632a331c1ba3f4a0bf6
icc_14_off0054e057.icc pdf-icc-profile PDF ICC profile at offset 0x54E057 408 bytes
SHA-256: 653b586c4707574ffcd648ba35494daed2c76ceafcf4c07d315ed961b1dc347f
font_00_sfnt_off00001188.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1188 15608 bytes
SHA-256: afb1800443c2265284abbe82bd91d900b4b6fc81c538dd02cbe09d8ca29e3da7
font_01_sfnt_off00002f7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F7D 6792 bytes
SHA-256: 35bd86f501683f796895320e4494ad06764baab9c3c73695dcdc6e9d89e2d63e
font_02_sfnt_off0007ccb6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7CCB6 5416 bytes
SHA-256: 75fda0e9b03f74cc7f5eee5361d2ef3de3d363956bb2802ead13a88af0deb8df
font_03_sfnt_off0007e675.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E675 5960 bytes
SHA-256: f9f8405cdfc8573a706cd713dfb5b7e7e508c2b5dbde81d524362e788b3de2bd
font_04_sfnt_off0008ac5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8AC5F 13568 bytes
SHA-256: 88f532f81a287481bc3f85820a09c97882b26598a6ad55ae429b04a3347e8f21
font_05_sfnt_off000933e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x933E8 8352 bytes
SHA-256: 9aabd9144aa52404080f8d352307b94a8ebca4523f054250e2395fd9a08736bc
font_06_sfnt_off0009e06e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E06E 8656 bytes
SHA-256: 1ad0df3b723d9cfa1486ecb4ca4d3e826bff4160ff1daf4f968ef3e1fdd611cb
font_07_sfnt_off000a2874.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA2874 5508 bytes
SHA-256: 998fb252b5be47a1cc9961008174f4c33faf800183b823588958cc8a4080267b
font_09_sfnt_off000d21d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD21D9 3300 bytes
SHA-256: 099382d28598f8b576b672eb3cb64ce703467a001dce304b0ed7b742c7ab90dd
font_11_sfnt_off000d4b7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4B7E 3912 bytes
SHA-256: 1aa19aef6b0edeb4d3f6d06dbeb9fdd9331eff016befb9709d8b5c6e34f351af
font_12_sfnt_off000d60b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD60B5 35572 bytes
SHA-256: c890d0cc0f36f9eb9b2415cbfdcefbd71efe27e21b19672bccd844316b4ac4ae
font_13_sfnt_off000e6455.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6455 20836 bytes
SHA-256: 83f201270cab88c5857aa270d2bc3f73198763ed2406b58739b9740d92bfca40
font_14_sfnt_off000e835f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE835F 23484 bytes
SHA-256: 800e5213005c57df0ba77a2c1b49b0be39154c6fb0e64b0fc79b45c7b5ba071c
font_15_sfnt_off000ebb8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB8B 11936 bytes
SHA-256: 3fceb1e249f93a0a77c10f13968dd5a8c242be64522ff354563d231d60993e4b
font_16_sfnt_off0014b7c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B7C3 7528 bytes
SHA-256: fd2cca8b48402f79463b7d4421ecc224d3abf4df3b2e2fa19f1591cbb5222a34
font_17_sfnt_off00190abc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x190ABC 22704 bytes
SHA-256: 73fa33a022a81d9b0df92ce8f68b1dcd86eb20e912f2c141051d6604792badd6
font_18_sfnt_off00194e7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x194E7B 41980 bytes
SHA-256: 527b5108e33e59c7cf79b95a15454ff739ca19c458a400db774c5317be6371a9
font_19_sfnt_off0019ba77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19BA77 20016 bytes
SHA-256: 1475beb6efea9afc02c4fcf3a19205ac0e728446ae62b44b7ba000b6e541e788

Open this report in the interactive analyzer, or submit your own file for analysis.