PDF / .VIR static analysis report

Static analysis result for SHA-256 1dd27913bab88f00…

CLEAN

PDF / .VIR

662.1 KB Created: 2023-09-01 09:00:12 Authoring application: PDFedit First seen: 2024-09-20
MD5: 122ea56ea7ac78c7be6e12a9aa19fd89 SHA-1: 48d7c0d6f7fd0469f592ba4597e8193af3db7b84 SHA-256: 1dd27913bab88f00e5c648fe62989d70599dca4b40a92564d03abcd751fee387
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.2335

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://hunger-games-catching-fire-book-pdf.spancer-doom.de/dibimexuva.pdf In PDF document text
    • https://adservice.google.co.tz/ddm/clk/408533097;208818505;l;;%3F//uploads-ssl.webflow.com/64ee13ade4904b0f4cc355de/65615fb9134c5c08c0087606_gedofasusi.pdfIn PDF document text
    • https://adservice.google.com.pk/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/23877211424.pdfIn PDF document text
    • https://adservice.google.com.na/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/47856eb6-5d24-4e85-b95b-048013579357/downloads/85187319840.pdfIn PDF document text
    • https://adservice.google.co.th/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/genaredew.pdfIn PDF document text
    • https://adservice.google.com.bd/ddm/clk/448794861;252804937;a;;%3F//uploads-ssl.webflow.com/64edf97704bc1f5d88013780/65615f86c44b415eac4811b0_11111823406.pdfIn PDF document text
    • https://adservice.google.com.cy/ddm/clk/300948314;127869103;e;;%3F//uploads-ssl.webflow.com/64f1a70702940058e3b5c2c4/65615f6280f3c207d74c0f7a_xozelefanigiruletumomoka.pdfIn PDF document text
    • https://adservice.google.com.om/ddm/clk/445204615;249060672;c;;%3F//uploads-ssl.webflow.com/64f84e64032ded1e2719c97a/65615f46e46c4adf3c0bb512_nesukewujavul.pdfIn PDF document text
    • https://kogilore.laday.net/185087.pdfIn PDF document text
    • https://adservice.google.com.ar/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/58386598326.pdfIn PDF document text
    • https://adservice.google.co.ug/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/78c14b69-39ed-4d94-8d63-a7b29776e43c/downloads/rugebod.pdfIn PDF document text
    • https://financial-markets-and-institutions-mishk.lancsports.com/lubi.pdfIn PDF document text
    • https://adservice.google.is/ddm/clk/426382440;228185261;d;;%3F//2014-suzuki-gsxr-750-service-manual-pdf.leib-kosmetik.de/161111.pdfPDF link annotation
    • https://img1.wsimg.com/blobby/go/47856eb6-5d24-4e85-b95b-048013579357/downloads/4763756230.pdfIn PDF document text
    • https://adservice.google.hn/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/retis.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/7903106090.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64ee183023cd69c17cd83529/65615f413c18ede96cc30ddc_tewevudikixazedu.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/8b80a7c3-af1c-4228-bbaa-662dd566b832/downloads/download_apk_easy_tool_for_windows_10.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/78c14b69-39ed-4d94-8d63-a7b29776e43c/downloads/tv_guide_toronto_bell_fibe.pdfIn PDF document text
    • https://adservice.google.ae/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/gusogikovidoxe.pdfIn PDF document text
    • https://adservice.google.co.uk/ddm/clk/424929466;226923624;r;;%3F//uploads-ssl.webflow.com/64ee13ade4904b0f4cc355de/65615fd7afefa88deb80efc7_86187093196.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f19978e6b212d8aff09bb3/65615f48afefa88deb809f46_guguxorusofevovogad.pdfIn PDF document text
    • https://adservice.google.ca/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/78c14b69-39ed-4d94-8d63-a7b29776e43c/downloads/43840171671.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/2eabcd0a-1fbf-48aa-8399-71392232a891/downloads/vujunafukalatimisizimamew.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f1b20def55fdc96a25af30/65615f6b6a2068e01de91c5b_45676268118.pdfIn PDF document text
    • https://adservice.google.cv/ddm/clk/426382440;228185261;d;;%3F//uploads-ssl.webflow.com/64f19978e6b212d8aff09bb3/65615fbd44b94dd536796433_12376017427.pdfIn PDF document text
    • https://adservice.google.hr/ddm/clk/408533097;208818505;l;;%3F//uploads-ssl.webflow.com/64ee13ade4904b0f4cc355de/65615fc57688a3e47632929f_roxaginujedenogeni.pdfIn PDF document text
    • https://adservice.google.jo/ddm/clk/310682673;138356009;g;;%3F//uploads-ssl.webflow.com/64ee14c549be5b4b9a036151/65615fb3134c5c08c0086fc2_26949585691.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/78c14b69-39ed-4d94-8d63-a7b29776e43c/downloads/28389651552.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/78c14b69-39ed-4d94-8d63-a7b29776e43c/downloads/vojixunenubikojul.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/47856eb6-5d24-4e85-b95b-048013579357/downloads/xatogeteg.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000a02b5.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000a02b5.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000a02b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA02B5 15748 bytes
SHA-256: a5279143bb188f4f7c8d2e5ec203f44f810b5af7a9a5a393fcaf0e39f9749113
font_01_sfnt_off000a293a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA293A 12292 bytes
SHA-256: 871869f8ce8ee525dfa9736a763de30eaa81fa58c55b951ab3900081e2069707