Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 223d345fc0791df1…

MALICIOUS

PDF / .VIR

172.2 KB Created: 2021-11-28 23:01:42 +01:00 Authoring application: nicaby (via PDF Master 1.0.1) First seen: 2024-10-15
MD5: 3b5bef3bb1f739f1972d41b2de59094f SHA-1: 74e0b8a77911500c6e8ef828f51f5283d2b6eb39 SHA-256: 223d345fc0791df13c93792fbc2fe33a6405fed6d28ad430b8403c9c18fcb118
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0183

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinurli.com/29fuy4 PDF link annotation
    • https://pdfslide.net/software/pro100-v52-torrent-free-17-doeil-chipset-degras.htmlIn PDF document text
    • https://himoin.com/upload/files/2021/11/751EtOyDuOpHYsgDHcy9_28_a3574a649b129cf8d77c982bb555ac77_file.pdfIn PDF document text
    • https://community.thecityhubproject.com/upload/files/2021/11/ECpw6rFcKbmoNS7z9fzi_28_a3574a649b129cf8d77c982bb555ac77_file.pdfIn PDF document text
    • https://besuloho.weebly.com/der-kleine-trommler-noten-pdf-11.htmlIn PDF document text
    • https://www.buvidi.com/upload/files/2021/11/IzpKkHRZfrLZG5LWuEGy_28_bdefedfcc64f76881a884fe4b7d999e5_file.pdfIn PDF document text
    • https://www.drupal.org/files/issues/2021-11-29/Creation-2009-LiMiTED-1080p-BluRay-X264-AVCHDzip.pdfIn PDF document text
    • https://killliproufo.mystrikingly.com/blog/x264-carminat-navigation-v-film-dubbed-free-watch-online-video-720pIn PDF document text
    • https://seesaawiki.jp/obskidefil/d/IntelIn PDF document text
    • https://wakelet.com/wake/1lXUS98okASFTq8AFVGwJIn PDF document text
    • https://emntesbetemppres.wixsite.com/ziaprovalto/post/m-mmapsofeurope9456175retailnavigon-pc-download-crack-registration-32bit-zip-latestIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000c39.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC39 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000ba1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA1C 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.