Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 04816642b7e22cd2…

MALICIOUS

PDF / .VIR

9.11 MB First seen: 2026-07-07
MD5: 6f37620e59c09e9a92700db9419b88b0 SHA-1: 2ef069e84fed613a03364862230e192e1e1de6c8 SHA-256: 04816642b7e22cd2f4ed870b47372fa3053fecc0ac7a0cd45c36cc827ee881c7
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1255

Heuristics 5

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cfi-blog.org In PDF document text
    • http://www.afi-global.org/sites/default/files/publications/2016-08/FS-Maya-A5-digital.pdfIn PDF document text
    • http://www.afi-global.org/news-events/press-releases/afi-response-g20In PDF document text
    • http://www.cgap.org/blog/financial-inclusion-running-last-mileIn PDF document text
    • http://www.cgap.org/sites/default/files/Working-Paper-Digital-Finance-and%20In PDF document text
    • http://www.careinternational.org.uk/linking-for-change/images/technical%20learning%20In PDF document text
    • http://www.cgap.org/sites/default/files/Working-Paper-Market-Stystem-In PDF document text
    • http://mckinseyonsociety.com/In PDF document text
    • https://www.cgap.org/sites/default/files/Brief_bKash_In PDF document text
    • http://karandaaz.com.pk/sites/default/files/downloads/Karandaaz-P2G-In PDF document text
    • http://databank.worldbankIn PDF document text
    • http://www.worldenergyoutlook.org/resources/energydevelopment/energyaccessdatabase/WorldIn PDF document text
    • http://www.gpfi.org/about-gpfiIn PDF document text
    • http://grameenresearch.org/history-of-grameen-bank/In PDF document text
    • http://www.g20portal.com/national-strategies-to-fulfill-the-In PDF document text
    • http://www.ictworks.org/2015/10/16/digitizing-payments-one-cabinet-at-a-time/In PDF document text
    • http://finclusion.org/uploads/file/In PDF document text
    • http://www.cgap.org/sites/default/In PDF document text
    • http://www.telesemana.com/blog/2015/01/15/paraguay-casi-el-20-de-la-In PDF document text
    • https://www.freedomfromhunger.org/sites/default/files/documents/FFH_FinancialLinkagesPilotProjectReport_v2_eng.pdfIn PDF document text
    • http://www.microinsurancenetwork.org/brief-historyIn PDF document text
    • http://www.millicom.com/media/millicom-news-features/tigo-money-bolivia/In PDF document text
    • http://www.grips.ac.jp/r-center/wp-content/uploads/14-22.pdfIn PDF document text
    • http://www.thecitizen.co.tz/News/Dawasco-hails-M-Pesa-billing/-/1840392/1910782/-/7emg2u/-/indexIn PDF document text
    • http://www.gsmaIn PDF document text
    • http://www.sadcbanking.org/pdf/SADC_Payments_Project.pdfIn PDF document text
    • https://www.safaricom.co.ke/investor-relation/financials-and-reports/annual-reportsIn PDF document text
    • https://www.safaricom.co.ke/investor-relationIn PDF document text
    • http://www.safaricom.co.ke/mpesa_timeline/timeline.htmlIn PDF document text
    • https://www.cgap.org/sites/default/In PDF document text
    • http://www.gpfi.org/sites/default/files/documents/In PDF document text
    • https://www.unsgsa.org/about/queen-maxima-unsgsaIn PDF document text
    • https://www.hfgproject.org/wp-content/uploads/2015/10/HFG-Mobile-Money-Compendium_In PDF document text
    • http://vodacom.onlinereport.co.za/vodacom_ir_2015/downloads/Vodacom_In PDF document text
    • http://digitalcollections.sit.edu/isp_collection/1246In PDF document text
    • https://www.wsp.org/sites/wsp.org/files/publications/WSP-Improving-Services-for-the-Nairobi-Water-Sewerage-Utility-Kenya.pdfIn PDF document text
    • https://www.wssinfo.org/fileadmin/In PDF document text
    • http://ns.camerabits.com/photomechanic/1.0/In PDF document text
    • https://www.gsmaintelligence.com/research/2016/11/market-size-and-opportunity-in-digitising-payments-in-agricultural-value-chains/589/%20In PDF document text
    • http://www.cgap.org/sites/default/files/Working-Paper-Digital-Finance-and%2520Innovations-in-Financing-for-Education.pdf%20%20In PDF document text
    • http://www.careinternational.org.uk/linking-for-change/images/technical%2520learning%2520series%2520publication%25202%2520-%2520mobile%2520banking%2520tanzania.pdf%20In PDF document text
    • http://www.cgap.org/sites/default/files/Working-Paper-Market-Stystem-Assessment-of-Digital-Financial-Services-in-WAEMU_0.pdfIn PDF document text
    • http://mckinseyonsociety.com/half-the-world-is-unbanked/%20In PDF document text
    • https://www.cgap.org/sites/default/files/Brief_bKash_Bangladesh_July_2014.pdf%20In PDF document text
    • http://finclusion.org/uploads/file/reports/FII-Kenya-Wave-One-Wave-Report.pdfIn PDF document text
    • http://finclusion.org/uploads/file/reports/FII-Kenya-Wave-One-Wave-Report.pdf%20In PDF document text
    • http://www.cgap.org/sites/default/files/Working-Paper-Achieving-Sustainable-Development-Goals-Apr-2016_0.pdf%20In PDF document text
    • http://www.thecitizen.co.tz/News/Dawasco-hails-M-Pesa-billing/-/1840392/1910782/-/7emg2u/-/index.html%20In PDF document text
    • https://www.safaricom.co.ke/images/Downloads/Resources_Downloads/Safaricom_Limited_2016_Annual_Report.pdf%20In PDF document text
    • https://www.safaricom.co.ke/images/Downloads/Resources_Downloads/HY2017/Safaricom_H1FY17%20Presentation.pdf%20In PDF document text
    +151 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off000032ff.icc pdf-icc-profile PDF ICC profile at offset 0x32FF 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00002167.bin pdf-font-stream PDF embedded font (cff) at offset 0x2167 4439 bytes
SHA-256: 68b33074e0881a75ae9edbdda37654b526c6bc0cd75d1eee42872ff7fa840381
font_01_cff_off00003d64.bin pdf-font-stream PDF embedded font (cff) at offset 0x3D64 7325 bytes
SHA-256: eec5199a0dc2f3f9c7195087cb93929115f4ed4e2c2de03854650f7e04a8a634
font_02_cff_off0019c5d3.bin pdf-font-stream PDF embedded font (cff) at offset 0x19C5D3 549 bytes
SHA-256: 34eaf94b0d330e18b19cf286e5c388cea8f7a6fbc6ffd9fe29d0a58a17e9f391
font_03_cff_off0081d22d.bin pdf-font-stream PDF embedded font (cff) at offset 0x81D22D 1954 bytes
SHA-256: 52bc437ad0717ff54637c7154f97b004a37ee256700607794a39a301fd9908d6
font_04_cff_off008e516a.bin pdf-font-stream PDF embedded font (cff) at offset 0x8E516A 1609 bytes
SHA-256: 2e140e75371923daf06af792563611316306f86a14a0465abd9c73a0b330803b
font_05_cff_off009020f8.bin pdf-font-stream PDF embedded font (cff) at offset 0x9020F8 4008 bytes
SHA-256: 5f06b542b0f5905dcf9fbe7b83c0084ed30e2be0f9cbc3644eb30871386d670b
font_06_cff_off009033fb.bin pdf-font-stream PDF embedded font (cff) at offset 0x9033FB 2390 bytes
SHA-256: ff80bbf74824bfed8191e4fe9e90b10221354845b00252a141b6bcd4642038b3
font_07_cff_off009044a0.bin pdf-font-stream PDF embedded font (cff) at offset 0x9044A0 6527 bytes
SHA-256: a179c5c85efc2acdbbf672f33ab56cb2e2b656be48f51b6d3000923265fe1562
font_08_cff_off00905b3b.bin pdf-font-stream PDF embedded font (cff) at offset 0x905B3B 693 bytes
SHA-256: 5cd06d77dbbfd8b9df4bd8b21a33b73cf3f7db5eeb56bd98245bf78928535255
font_09_cff_off009063e6.bin pdf-font-stream PDF embedded font (cff) at offset 0x9063E6 269 bytes
SHA-256: 38159496fef5d090aaaefd9fc74409e123de5c677721725a72eaabc5688244e4
font_10_cff_off00906976.bin pdf-font-stream PDF embedded font (cff) at offset 0x906976 3006 bytes
SHA-256: 00990cc324f365c1dc2d2e3e19ddacb8e9f1f96459fdd04a6bb2cde96491fa28
font_11_cff_off00907b19.bin pdf-font-stream PDF embedded font (cff) at offset 0x907B19 5437 bytes
SHA-256: e04cac2dede14bcc0ce7785ea416671a1019b18a9709225192a4f0310577a8df
font_12_cff_off009094e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x9094E2 6769 bytes
SHA-256: a8c19207eb55e9724c78507161bafac132fa3266f183da689df2a8110cbe0e50
font_13_cff_off0090b391.bin pdf-font-stream PDF embedded font (cff) at offset 0x90B391 4130 bytes
SHA-256: 1685d37f4ea5d7daffffb15b7ed412e8ec33b3b6484e10387d0b71a12f02e8d3
font_14_cff_off0090c96b.bin pdf-font-stream PDF embedded font (cff) at offset 0x90C96B 1691 bytes
SHA-256: 99239ccc50c1f3ef9aa75da57d4f187e366f093770632e270b00f66db78d1f7c
font_15_cff_off0090d4ee.bin pdf-font-stream PDF embedded font (cff) at offset 0x90D4EE 2815 bytes
SHA-256: 20ea2720164f9419fba7e3af8cc89e166706607abfb8d8ea53827a604b89d7cc
font_16_cff_off0090e186.bin pdf-font-stream PDF embedded font (cff) at offset 0x90E186 2769 bytes
SHA-256: 88f7e6f06f5d4d584c52c474913a14cff0570c071a7263c9667f018b3b8dc9d7
font_17_cff_off0090ef81.bin pdf-font-stream PDF embedded font (cff) at offset 0x90EF81 2788 bytes
SHA-256: d76713526594c6f2d3e6e7dc2a1d7219845fd6031bbbb9ac26d333e30c414a04
font_18_cff_off00910095.bin pdf-font-stream PDF embedded font (cff) at offset 0x910095 4006 bytes
SHA-256: 3b4103ab665de82b49d2eef79c025d1fe965242629d8dc8973c8ba5d23fd3b2a
font_19_cff_off00911794.bin pdf-font-stream PDF embedded font (cff) at offset 0x911794 3051 bytes
SHA-256: 8b7e66ce4f77685ff1aeba0271afd3da931bd2d47bc4cb90e7601ce6f042ba5a
font_20_cff_off00912bea.bin pdf-font-stream PDF embedded font (cff) at offset 0x912BEA 3131 bytes
SHA-256: 0509760c4767cbe53123d5971ff39d5255e84a25e0ceade2588257567dfb64e0

Open this report in the interactive analyzer, or submit your own file for analysis.