PDF static analysis report

Static analysis result for SHA-256 faaf21d7bfb81d15…

SUSPICIOUS

PDF

255.7 KB Created: 2020-03-11 09:38:03 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-07
MD5: f1e97e701b3c751084ddc2ab8a412096 SHA-1: 68f336e015e5700aa43f56198b0854b24f19a41e SHA-256: faaf21d7bfb81d15c9af5f2207b0b71aa350fdf3af953a6a8032eb7581b8bfd0
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0394

Heuristics 3

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sdsufiji.com/uploads/1/3/0/4/130483572/130483572.html#ethnologist+music+definition PDF link annotation
    • http://myfish.tw/uploads/1/3/0/2/130289344/373a16a.pdfIn PDF document text
    • http://abundantlivingpsychologicalandcoachingservices.org/uploads/1/3/0/5/130539458/jozasowewapep.pdfIn PDF document text
    • http://myprintpad.com/uploads/1/3/0/5/130546538/zaluki_gisenek_nedaf_nifukuk.pdfIn PDF document text
    • http://www.arenteprises.com/uploads/1/3/0/3/130323220/af058e9fb.pdfIn PDF document text
    • http://www.drbreeawillingham.com/uploads/1/3/0/3/130323531/javoxili.pdfIn PDF document text
    • http://www.ofertagigante.com/uploads/1/3/0/8/130814960/9593316.pdfIn PDF document text
    • http://plussizeweddingdressesinnh.com/uploads/1/3/0/5/130546432/962692.pdfIn PDF document text
    • http://autodiscover.ruralrootz.com/uploads/1/3/0/2/130270889/mebojobojusewi_devokasiw.pdfIn PDF document text
    • http://ahoconline.com/uploads/1/3/0/2/130289480/kemokuxiwedalel.pdfIn PDF document text
    • http://morganvarn.com/uploads/1/3/0/3/130379158/10e7cb10baefe.pdfIn PDF document text
    • http://noccassoc.org/uploads/1/3/0/4/130490277/33c3899ea8cd2.pdfIn PDF document text
    • http://www.mimillari.com/uploads/1/3/0/4/130476469/8683790.pdfIn PDF document text
    • http://letslulu.com/uploads/1/3/0/2/130289543/6245263.pdfIn PDF document text
    • http://safedrivingschool.net/uploads/1/3/0/6/130620625/9127871.pdfIn PDF document text
    • http://barringtonintegrativehealth.com/uploads/1/3/0/8/130814900/0a6c893ac42c207.pdfIn PDF document text
    • http://peoplehacking.net/uploads/1/3/0/6/130639764/5374274.pdfIn PDF document text
    • http://serpboards.com/uploads/1/3/0/2/130288458/0ebe2f572cef9.pdfIn PDF document text
    • http://organicmatchmaker.com/uploads/1/3/0/5/130541623/6267265.pdfIn PDF document text
    • http://www.mariasblueridgemountainhoney.com/uploads/1/3/0/8/130873979/badagizuzezu-lafilagapugon-xanobivawon.pdfIn PDF document text
    • http://welcometo6h.com/uploads/1/3/0/5/130588601/d9d4183d8a3a.pdfIn PDF document text
    • http://bees-boss.org/uploads/1/3/0/7/130738939/c82edcd1e.pdfIn PDF document text
    • http://northshorepaintinginc.com/uploads/1/3/0/6/130604529/1780208.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003ab87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB87 11980 bytes
SHA-256: ecc48d71edab5c6e42e1eb1c4b12ad735c2af2cc728c514d2e0ed992805477d0
font_01_sfnt_off0003d1b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D1B4 4168 bytes
SHA-256: 7c89548b3424e8b091dc319a37d7cd22d1755d98e59ce7c7360d1167b4b339db
font_02_sfnt_off0003e054.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E054 16580 bytes
SHA-256: fb9f296fe9a842a70fb24e38db1caf0dd8d208cfcce78c1522188b5576180415