PDF / .VIR static analysis report

Static analysis result for SHA-256 06f1f6634461dc2e…

SUSPICIOUS

PDF / .VIR

392.3 KB Created: 2023-06-13 03:09:40 Authoring application: Smallpdf Desktop First seen: 2024-10-26
MD5: efbd0bf5de299d8b6c5da738f9239024 SHA-1: a65684a0dfcbe3520654d6baa0c8de665262b036 SHA-256: 06f1f6634461dc2eaa94b5c6bb1b81811b08c4b20841d5e2edb2528c749a2ecc
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8256

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://2004-harley-davidson-ultra-classic-repair-manual.tridentms.com/dojibotabetipik.pdf In PDF document text
    • https://mazda-manual-transmission-fluid-type-a.softwaredirectories.com/87911826303.pdfIn PDF document text
    • https://fisheries-books-free.soforso.com/92983489659.pdfIn PDF document text
    • https://instruction-manual-for-ozark-trail-3-person-tent.ctrlproxy.org/vikaxal.pdfIn PDF document text
    • https://green-machine-gt25-owners-manual.babymoko.com/99780650065.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/46a2ceaa-4593-4a1b-897f-3f613a2c8631/downloads/turup.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/383847ec-a1b4-4bfc-9813-79c50969444b/downloads/dujozivepepal.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/e63c6834-d8ce-4c18-ac9b-4fb597ef6157/downloads/ragaludofanobobagumame.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/46a2ceaa-4593-4a1b-897f-3f613a2c8631/downloads/63070610733.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/e63c6834-d8ce-4c18-ac9b-4fb597ef6157/downloads/vinejesabomewuzimusogap.pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005e3d1.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005e3d1.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005e3d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E3D1 18420 bytes
SHA-256: b8d4b07fac97e0cd7a528c6c17e4ee27158554f3de88689140f26640e80f4634