PDF / .VIR static analysis report

Static analysis result for SHA-256 068b905b2a05410c…

CLEAN

PDF / .VIR

353.4 KB Created: 2021-11-28 02:16:51 UTC Authoring application: LaTeX with hyperref (via pdfTeX-1.40.21) First seen: 2024-06-15
MD5: fb201fe0f93f057b5faa233ceb21302e SHA-1: bc3d346920e89ab042c174721af91a2e646515a9 SHA-256: 068b905b2a05410c3b49ce12fd026857a570b24bd8b6d5c6cbe8fe2c9ab58e94
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://matplotlib.org)/Producer In PDF document text
    • https://doi.org/10.5281/zenodo.4688086PDF link annotation
    • http://matplotlib.orgIn PDF document text
    • http://www.ams.orgIn extracted file (font_00_type1_off0001ba4b.bin)
    • http://scripts.sil.org/OFLIn extracted file (font_00_type1_off0001ba4b.bin)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 19

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0328_00.bin pdf-objstm-decoded PDF /ObjStm 328 0 obj (inflated) 14585 bytes
SHA-256: 59bf1e1fd471c67bd2f7c7be89e84a560b8c07b12f43adf4e7edb01a189475fe
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
font_00_type1_off0001ba4b.bin pdf-font-stream PDF embedded font (type1) at offset 0x1BA4B 8253 bytes
SHA-256: f8f717fff0b540282565269f73964be0f66845f5e22b7b8fe80c00edaab26523
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.86, consistent with packed or encrypted content.
font_01_type1_off0001d93f.bin pdf-font-stream PDF embedded font (type1) at offset 0x1D93F 9049 bytes
SHA-256: b34b2f1573a6b11c759490271402bafc2b249d923124580ff80675e34bd734af
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.86, consistent with packed or encrypted content.
font_02_type1_off0001fb1c.bin pdf-font-stream PDF embedded font (type1) at offset 0x1FB1C 13600 bytes
SHA-256: b06ddb62d8f3d718ea37948bf6d75c1197396473aebff62780c20674c6aa8129
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.90, consistent with packed or encrypted content.
font_03_type1_off00022de9.bin pdf-font-stream PDF embedded font (type1) at offset 0x22DE9 8781 bytes
SHA-256: b13a0b6aaf71554f59465ea5b0030d9c06a079a7c7bf327da06ebbce6ab9762a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
font_04_type1_off00024ebc.bin pdf-font-stream PDF embedded font (type1) at offset 0x24EBC 7415 bytes
SHA-256: 0fc1891eea260ecce0186e79f90a97e4f2b9a39cc2977f95cb34efe3f62c6f94
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.83, consistent with packed or encrypted content.
font_05_type1_off00026a67.bin pdf-font-stream PDF embedded font (type1) at offset 0x26A67 7486 bytes
SHA-256: 858401e283c9165ca1be59a4d663cabd3f322484edefb1c82fe2be5e0e140ee2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
font_06_type1_off00028662.bin pdf-font-stream PDF embedded font (type1) at offset 0x28662 7859 bytes
SHA-256: 01aad6c2989225dd7f7a05e3dc9c0347aefff6218d5123bac2d0075142764f15
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
font_07_type1_off0002a3c3.bin pdf-font-stream PDF embedded font (type1) at offset 0x2A3C3 7910 bytes
SHA-256: 556f00e70a4147cf5e5f38afd10f2f97426436d39421cab20bdc30ae22820f33
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
font_08_type1_off0002c160.bin pdf-font-stream PDF embedded font (type1) at offset 0x2C160 25586 bytes
SHA-256: f32b036a7eb1878b393c5664bb7736520d0e1c6661a466d524ea286f0c86053f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.94, consistent with packed or encrypted content.
font_09_type1_off0003215b.bin pdf-font-stream PDF embedded font (type1) at offset 0x3215B 9645 bytes
SHA-256: e0c968cfbefd97008e3a46ceb2ee326b537282e974521939c8aef0cbeca87382
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.88, consistent with packed or encrypted content.
font_10_type1_off0003458e.bin pdf-font-stream PDF embedded font (type1) at offset 0x3458E 9156 bytes
SHA-256: 4756d83f5f109c6afd008d3e8c662c5088588fffcca8bb092d9a9e1184768254
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.87, consistent with packed or encrypted content.
font_11_type1_off000367e7.bin pdf-font-stream PDF embedded font (type1) at offset 0x367E7 15224 bytes
SHA-256: b4ada432c72b206b2ea3030b0c1df2f61a6135bcf97a3beae00735124d4a9aed
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.91, consistent with packed or encrypted content.
font_12_type1_off0003a0d2.bin pdf-font-stream PDF embedded font (type1) at offset 0x3A0D2 23329 bytes
SHA-256: 9ccad6ca338c8ab7dee9410363c59faff20c7d4ba345f3ced1f1ddefe09f52ac
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.93, consistent with packed or encrypted content.
font_13_type1_off0003f845.bin pdf-font-stream PDF embedded font (type1) at offset 0x3F845 7830 bytes
SHA-256: 239153e4a9685fad3a7bbe0749267a848de612a4f064f8e3f0e110a9e4dd3362
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
font_14_type1_off00041589.bin pdf-font-stream PDF embedded font (type1) at offset 0x41589 7275 bytes
SHA-256: 7ab9752feff6ffb06a9ec5a32ee084cb540f97ca9970d9fdcae3afd39931b485
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.84, consistent with packed or encrypted content.
font_15_type1_off000430ba.bin pdf-font-stream PDF embedded font (type1) at offset 0x430BA 7352 bytes
SHA-256: e03a474887becea2f9e3768006c800f90a1beadb79fac20d5926fe7917efa13a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.84, consistent with packed or encrypted content.
font_16_type1_off00044c36.bin pdf-font-stream PDF embedded font (type1) at offset 0x44C36 10179 bytes
SHA-256: 0a1d6c0a9b1020776e7e7ef11eed4e71f375d01d79da03d425d5b87e77163b19
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.89, consistent with packed or encrypted content.
font_17_type1_off0004727f.bin pdf-font-stream PDF embedded font (type1) at offset 0x4727F 14970 bytes
SHA-256: b27f1ff4cddaa54b40a6dcefc55b3ea5c317680fb86b3629ff5b8e7888f65349
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.91, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.