Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 1ffd74b8a27bc48d…

MALICIOUS

PDF / .VIR

1016.3 KB Created: 2015-10-13 18:26:16 -04:00 Authoring application: Microsoft® Word 2010 First seen: 2024-11-17
MD5: 2110fd6a6ec3030f9b3cae7a6c860fd6 SHA-1: d7fafd67c7b2c24303cf9bb775368e2b66daa5bf SHA-256: 1ffd74b8a27bc48da74d22597193c3c31165a2a225d190ba78a5fa9dc200195c
72 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 4

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
    The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://undocs.org/sp/A/68/734 PDF link annotation
    • http://undocs.org/sp/A/68/387In PDF document text
    • http://undocs.org/sp/A/70/323In PDF document text
    • http://undocs.org/sp/A/70/343In PDF document text
    • http://undocs.org/sp/A/69/749In PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.