PDF / .VIR static analysis report

Static analysis result for SHA-256 173b314b724a84f9…

CLEAN

PDF / .VIR

109.5 KB Created: 2024-12-20 07:44:28 +00:00 Authoring application: mPDF 7.1.6 First seen: 2024-12-23
MD5: bc64634e4a53616875907ac4ccfd3f26 SHA-1: 4951b83725bdf6444f39886ed6255fa9c1c538aa SHA-256: 173b314b724a84f98caf972ae248b4646e9e5033ac7d75d11a8d5c1e7d05f9c1
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lowmp3.com/blues/141915-memphis-slim-you-got-to-help-me-some.html PDF link annotation
    • https://lowmp3.com/file.php?fn=TWVtcGhpcyBTbGltIC0gWW91IEdvdCBUbyBIZWxwIE1lIFNvbWUgKE1QMyk%3D&a=cmFy&s=MTg2MyBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=TWVtcGhpcyBTbGltIC0gWW91IEdvdCBUbyBIZWxwIE1lIFNvbWUgKEZMQUMp&a=cmFy&s=MTU2MCBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=TWVtcGhpcyBTbGltIC0gWW91IEdvdCBUbyBIZWxwIE1lIFNvbWUgKFdNQSk%3D&a=cmFy&s=MTgzOSBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=TWVtcGhpcyBTbGltIC0gWW91IEdvdCBUbyBIZWxwIE1lIFNvbWU%3D&a=bXAz&s=MTg2MyBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/blues/236532-memphis-slim-blues-portrait.pdfIn PDF document text
    • https://lowmp3.com/blues/233334-memphis-slim-boogie-for-my-friends.pdfIn PDF document text
    • https://lowmp3.com/blues/231950-memphis-slim-blues-masters.pdfIn PDF document text
    • https://lowmp3.com/blues/187767-memphis-slim-travelling-with-the-blues.pdfIn PDF document text
    • https://lowmp3.com/blues/184904-memphis-slim-bluessongs.pdfIn PDF document text
    • https://lowmp3.com/blues/115771-memphis-slimwillie-dixon-aux-trois-mailletz.pdfIn PDF document text
    • https://lowmp3.com/blues/110252-various-piano-blues-vol-2.pdfIn PDF document text
    • https://lowmp3.com/blues/108958-memphis-slim-beer-drinkin-woman.pdfIn PDF document text
    • https://lowmp3.com/blues/39700-memphis-slim-the-story.pdfIn PDF document text
    • https://lowmp3.com/blues/1953-memphis-jug-band-memphis-jug-band.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_003_off00002282.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_003_off00002282.bin)
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00002282.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2282 19824 bytes
SHA-256: b5a056ebcfa63b81c85d4fd1ac3bc6fe76845c50664add9735242967184c2e9d
font_01_sfnt_off00005651.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5651 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00008a69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A69 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1

Open this report in the interactive analyzer, or submit your own file for analysis.