PDF / .VIR static analysis report

Static analysis result for SHA-256 088ccd287257c760…

SUSPICIOUS

PDF / .VIR

6.96 MB Created: 2025-08-29 12:05:40 -04:00 Authoring application: Adobe InDesign 20.5 (Macintosh) (via Adobe PDF Library 17.0) First seen: 2026-06-29
MD5: 3119a6f530adc27fb476e8fec9d80a90 SHA-1: df8b934d0bdfc986b60c1dd368eba381c98f700f SHA-256: 088ccd287257c760503d037cc8e6709c3f1cf3b08b7cbfecbb04d58fdaddbcbd
56 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6143

Heuristics 4

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://marshalljordan.sites.cbmoxi.com/ In PDF document text
    • http://www.sccsc.eduIn PDF document text
    • https://hotspotcstore.com/foodservice/hop-spot/east-henry-hot-spot/In PDF document text
    • https://spartanburgfamilydentistry.com/In PDF document text
    • http://cipa.jp/exif/1.0/In PDF document text
    • https://www.scsdb.org/PDF link annotation
    • https://ellislawupstate.com/In PDF document text
    • https://www.wofford.edu/student-experiences/arts-cultureIn PDF document text
    • https://spartanburglittletheatre.com/In PDF document text
    • https://www.spartanburgyouththeatre.com/In PDF document text
    • http://ns.useplus.org/ldf/xmp/1.0/In PDF document text
    • http://www.istock.comIn PDF document text
    • http://www.janney.comIn PDF document text
    • https://www.hatchergarden.org/In PDF document text
    • https://www.jshwlaw.com/In PDF document text
    • https://uscupstate.edu/student-experience/campus-and-facilities/theatre/now-playing/In PDF document text
    • https://vlester.sites.cbmoxi.com/In PDF document text
    • http://ns.attribution.com/ads/1.0/In PDF document text
    • http://www.webecruising.comIn PDF document text
    • http://www.kdtriallawyers.comIn PDF document text
    • https://mspspartanburg.com/In PDF document text
    • http://www.goldencareerstrategies.comIn PDF document text
    • https://locations.burnbootcamp.com/locations/spartanburg-sc/?utm_source=gmb&utm_medium=listingsIn PDF document text
    • http://www.comfortkeepers.comIn PDF document text
    • https://www.naiearlefurman.com/divisions/retail/In PDF document text
    • https://www.spartanburg7.org/In PDF document text
    • http://www.gotchaboat.comIn PDF document text
    • http://kimklassen.comIn PDF document text
    • http://www.spartanburglibraries.orgIn PDF document text
    • http://www.palmettoproactive.comIn PDF document text
    • https://smithandbeckey.com/In PDF document text
    • https://farmfaregrocery.com/In PDF document text
    • https://ethridgelawgroup.com/In PDF document text
    • https://proudmarytheatre.com/In PDF document text
    • https://www.subaruofspartanburg.com/?utm_source=google&utm_medium=cpc&utm_campaign=dealership%20name%20-%20In%20AOR%20-%20New&sd_campaign=dealership%20name%20-%20In%20AOR%20-%20New&sd_digadprov=foundationdirect&sd_channel=search&sd_program=tier3&sd_adid=7In PDF document text
    • https://www.istoystore.com/In PDF document text
    • https://carolinawoodworks.com/In PDF document text
    • http://www.sphil.orgIn PDF document text
    • http://www.balletspartanburg.orgIn PDF document text
    • http://www.spartanburgyouththeatre.comIn PDF document text
    • http://simonwebdesign.comIn PDF document text
    • http://www.broadwayinspartanburg.comIn PDF document text
    • https://brusters.com/In PDF document text
    • https://www.spartanburgdayschool.org/In PDF document text
    • http://www.spartanburglittletheatre.com/contributeIn PDF document text
    • http://theskilletspartanburg.com/?gad_source=1&gad_campaignid=13289220950&gbraid=0AAAAACylPIvz_OtEW-fffTDOfmwzYjkDZ&gclid=Cj0KCQjwn8XFBhCxARIsAMyH8BtNUC0l6QkmRzZPdcd4ewrSGIw4Oh-gfdr-9PJevtk1On4bSp5oyxEaAh8mEALw_wcBIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    +38 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_038_off00050bb2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50BB2 236736 bytes
SHA-256: cb71c1663a00d2c4405dc31b83721a55605f96290130cb8f9530a20af9a590be
stream_068_off000a6d48.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA6D48 2748 bytes
SHA-256: 197da12039ee11cfc0385e6bc1fb02efaac2ba601fdc2a5b912f3b0178c84cf6
stream_114_off00109f59.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x109F59 6285 bytes
SHA-256: bc070177613bc5b28d820bca6564afe93cc0d8e9e936de1007e3c60d46292baa
stream_129_off001c55c6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C55C6 4253 bytes
SHA-256: 80a6b63320487cdb99529be47ad64943fd74dc0f1cceb8df554335d8e5535822
icc_00_off0000bc3a.icc pdf-icc-profile PDF ICC profile at offset 0xBC3A 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0000a37c.bin pdf-font-stream PDF embedded font (cff) at offset 0xA37C 3206 bytes
SHA-256: 5417ba92cfd5e4a20e9738f15a38e5b64b5c57d50177949899db48a1de6d41c7
font_01_cff_off0000afa2.bin pdf-font-stream PDF embedded font (cff) at offset 0xAFA2 3435 bytes
SHA-256: bdcb843bf7adc5d17099dbd1f18c08d5f170c31e70f313c98503bb69f2fa2198
font_02_cff_off0000c69f.bin pdf-font-stream PDF embedded font (cff) at offset 0xC69F 5011 bytes
SHA-256: 23e9bc9c4a01bf5da342de79dbaa617873e2f0484e083db06e3f55f26de7d02b
font_03_cff_off0001344b.bin pdf-font-stream PDF embedded font (cff) at offset 0x1344B 3315 bytes
SHA-256: 78f34a9ff8ced0cbcc11961913faa56c88f50158516480105f91f9c4602df4e2
font_04_cff_off000143b2.bin pdf-font-stream PDF embedded font (cff) at offset 0x143B2 736 bytes
SHA-256: f3199ae4884ede3904ebe0df92351ce08ea0688ca65532912adebf9c88ba6e94
font_05_cff_off000a5f3f.bin pdf-font-stream PDF embedded font (cff) at offset 0xA5F3F 3121 bytes
SHA-256: cd6a5acc3d2f8a692e2296900a5ae2d74296586e19c4fa0cc88cdd5b184042e3
font_07_cff_off000a7abf.bin pdf-font-stream PDF embedded font (cff) at offset 0xA7ABF 2524 bytes
SHA-256: 6cfec7ea7ae56b09c7d29fc827356a826fa1d2b8e84e68e92fa3d8871bc5e536
font_08_cff_off000a86b9.bin pdf-font-stream PDF embedded font (cff) at offset 0xA86B9 2200 bytes
SHA-256: b8b3347f3e0c7af7d5dc73fe4200c5858a67a96de78b65fedd100727aeda7b82
font_09_sfnt_off000b7967.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB7967 2776 bytes
SHA-256: 529e6a760fc1125a028a94b8a45388720799902464ff12bd426370d187ad0911
font_10_sfnt_off000b84be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB84BE 2210 bytes
SHA-256: caea5388d110c6d51e2687bf44c39117e3ce02d213fd3722b038176606842987
font_11_sfnt_off000b8d3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB8D3F 4174 bytes
SHA-256: c52f9f34a0cf2bb4d795ee71c53864e77b88f23a16a9d784d148406e07ac64ec
font_12_cff_off000dec7e.bin pdf-font-stream PDF embedded font (cff) at offset 0xDEC7E 3635 bytes
SHA-256: b20aee155c1d45e07088423911bddf367563b864a839225b341b9cda02a0668c
font_13_cff_off000dfd89.bin pdf-font-stream PDF embedded font (cff) at offset 0xDFD89 2509 bytes
SHA-256: 176ff47b5afcf2f1eec766cd593d457ec765fdfd65f94d9a16c69157a0dd11e2
font_14_cff_off000f67d2.bin pdf-font-stream PDF embedded font (cff) at offset 0xF67D2 4558 bytes
SHA-256: 4c53ac336f1d8c18e61c23ec2e6b49f2bda6bcdebd5300ab3e214a6d9d3ceef8
font_15_cff_off000f7da2.bin pdf-font-stream PDF embedded font (cff) at offset 0xF7DA2 2894 bytes
SHA-256: 3aebd331a336e2cef91ba5372a38269b604963fa03533d8c373208e7e67c7417
font_16_cff_off000f8d04.bin pdf-font-stream PDF embedded font (cff) at offset 0xF8D04 4275 bytes
SHA-256: f4de4e76270f8ef82b8f66297654e0a5bf433859a517740c82f82dc3e7f91f0c
font_17_cff_off001092d5.bin pdf-font-stream PDF embedded font (cff) at offset 0x1092D5 2430 bytes
SHA-256: f16a36fe512a37516a915201cec6e559c711877232b73c697bc3f141690f8a98
font_19_cff_off001767e7.bin pdf-font-stream PDF embedded font (cff) at offset 0x1767E7 980 bytes
SHA-256: 343091c2d11eb2c4f8980fc6b65bee4a573f6a2ffe3f4ba716bd7b2aeb2a1c93
font_20_sfnt_off0019a588.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A588 14801 bytes
SHA-256: 4fad1c8a1847886b8ca2cb9b3ce13528a4e3741d0f7b70f6627bcd9367b4c44b
font_21_cff_off0019cf2e.bin pdf-font-stream PDF embedded font (cff) at offset 0x19CF2E 2064 bytes
SHA-256: 4df47b4be680aad99dec9e57fea5b70a7ba27d2d5aca26925e98c04075a5ce04
font_22_sfnt_off0019d9ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19D9ED 10339 bytes
SHA-256: 98b4f37bdf7f29c64ef8d67d3bf9a85bbc56faa2cbd3abb98e7de60c6a71bb46
font_23_sfnt_off001a9e40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A9E40 7574 bytes
SHA-256: 50fe7d266fdf83e7f50e3241945630ed8aa9f8b551232231a4690814e6407298
font_24_sfnt_off001c22a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C22A4 17073 bytes
SHA-256: 9860e772ce177ffff144cdac5c693b4d449c1a7ffe0ea5860259cb302cb0106e
font_25_sfnt_off001c42a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C42A9 6576 bytes
SHA-256: 9aa1998ab228329726930fa5de08741eedb7e4813d670e71c9463610e37f79cd
font_27_sfnt_off001c610b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C610B 8760 bytes
SHA-256: 689e75fbe99352a8bee7d7796177c1cbd14b5daa1f6a979dcd3aeb357a2946da
font_28_sfnt_off001c774d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C774D 17739 bytes
SHA-256: 26ad1bd8d17918d686f7068ee2aea780072775061a99cae7963b834852250ba4
font_29_cff_off001eaf71.bin pdf-font-stream PDF embedded font (cff) at offset 0x1EAF71 2812 bytes
SHA-256: 2b621b1c124fe08cb519483ada0af177cc12807d900ee0566c01229c42504bde

Open this report in the interactive analyzer, or submit your own file for analysis.