Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 206de0f751f19ff6…

MALICIOUS

PDF / .VIR

569.7 KB Created: 2023-08-01 18:15:23 Authoring application: Karbon First seen: 2024-09-20
MD5: 93b3b49af83defcf9a1c6e6f27f826fc SHA-1: b761c053932414b1ed80573fa8de5821c9ec3436 SHA-256: 206de0f751f19ff6e4d4492a793884f8fe95f361a0e0fddba3f25098c6851e75
66 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0950

Heuristics 4

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://adservice.google.com.bz/ddm/clk/408405163;208572896;n;;%3F//html-to-pdf-node.ramadainnsiliconvalley.com/rorokitudedifexud.pdf In PDF document text
    • https://adservice.google.co.mz/ddm/clk/466651624;272226156;i;;%3F//uploads-ssl.webflow.com/64ee25c60606d5a7751ace23/6566e4791b0c0cb5712ec01b_63165670094.pdfIn PDF document text
    • https://zijob.bipumedav.cfd/8666568.pdfIn PDF document text
    • https://adservice.google.com.py/ddm/clk/295204063;122181591;w;;%3F//nadom.bni-onlineshop.de/jidomakenafaz.pdfIn PDF document text
    • https://adservice.google.com.mm/ddm/clk/466651624;272226156;i;;%3F//pakanopip.hundepension-werder.de/35.pdfIn PDF document text
    • https://adservice.google.com.af/ddm/clk/448794861;252804937;a;;%3F//resurrecting-zora-khan-academy-answers.gojobinaxu.cfd/84.pdfIn PDF document text
    • https://adservice.google.co.uz/ddm/clk/300948314;127869103;e;;%3F//uploads-ssl.webflow.com/64f84925f49f58f016018ad0/6566e420a3935b8480e8d81d_duzuxubig.pdfPDF link annotation
    • https://zodosapoxin.rupesutit.cfd/pekijodijaxir.pdfIn PDF document text
    • https://adservice.google.ne/ddm/clk/448794861;252804937;a;;%3F//uploads-ssl.webflow.com/64f84b546061ea64dda78f20/6566e453fed7aaaed5fe1ab6_vilagagu.pdfIn PDF document text
    • https://adservice.google.ba/ddm/clk/300948314;127869103;e;;%3F//improve-your-conversations-pdf.baxarirora.online/45.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f1a8db8fa7cb489962a222/6566e44ab73f8c2894328df6_takedebufiwusu.pdfIn PDF document text
    • https://adservice.google.tm/ddm/clk/295204063;122181591;w;;%3F//othello-study-guide-and-journal-answers.gewinnen-reservix.de/mujunagakope.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f855713934ea24a2a72b70/6566e416a5e4ff5036b1905f_9553688685.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f857e43a05ffa005348c19/6566e2ad026f22092b0df489_fusirafovovumiw.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f855713934ea24a2a72b70/6566e3df19db7d7beced27c2_17593144473.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f84f2a92c244ded859bc4b/6566e417a5bd9c4c21d06d98_58252193084.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f84d9fe61b07607d391352/6566e416026f22092b0ebb3d_33781397764.pdfIn PDF document text
    • https://adservice.google.ie/ddm/clk/408533097;208818505;l;;%3F//uploads-ssl.webflow.com/64ee1d2a2f8df52e1f7b126f/6566e2aea5bd9c4c21cf9f59_20719395737.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00087d52.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00087d52.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00087d52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87D52 10412 bytes
SHA-256: d4f59c064f388bdba9ba5f9db144bdfcf5a677dd421160ccc638506f8473da8a
font_01_sfnt_off000894e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x894E2 22232 bytes
SHA-256: 614f63ba36608d7b69635c62ed4163e1b42df535f835136f72f1ffa9c33ba79a

Open this report in the interactive analyzer, or submit your own file for analysis.