PDF static analysis report

Static analysis result for SHA-256 f65a2c98922252ff…

CLEAN

PDF

5.9 KB Created: 2015-06-06 06:31:58 Authoring application: HTML2FPDF >> http://html2fpdf.sf.net (via FPDF 1.52) First seen: 2015-07-16
MD5: 1c892065d4430a10cf58215499cf9bb9 SHA-1: ceb45bd000cb7065e314125a6ae9d9e19c7a1e01 SHA-256: f65a2c98922252ff660ebdb168440706fcfc9280b89566bb3d8ee67d4b4d33b3
12 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

The PDF file contains embedded JavaScript and multiple external URIs. The document body, while containing pharmaceutical-related text, also embeds several URLs that are likely malicious, indicated by their suspicious paths and the 'unknown' reputation. The embedded JavaScript stream suggests an attempt to execute code, potentially to download further payloads or redirect the user to malicious sites. The presence of these elements points towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0110

Heuristics 3

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.graphicsdesignoutsourcing.com/css/img/best-cialis-prices/ Referenced by PDF JavaScript
    • http://www.meghniwas.com/oldsite/ESW/u.php/womens-viagra-2013/In PDF document text
    • http://www.plushaut.net/fckeditor/editor/js/pdf.php/ann-summers-viagra-pills.pdfIn PDF document text
    • http://www.plushaut.net/fckeditor/editor/js/pdf.php/tachycardia-prednisone.pdfIn PDF document text
    • http://html2fpdf.sf.net)/CreationDateIn PDF document text
    • http://html2fpdf.sf.netIn PDF document text
🗂 Part of campaign: sf.net 56 samples