PDF / .VIR static analysis report

Static analysis result for SHA-256 25dc8558b2a97218…

SUSPICIOUS

PDF / .VIR

436.9 KB Created: 2022-01-05 18:07:12 -05:00 Authoring application: Adobe InDesign 17.0 (Macintosh) (via 3-Heights(TM) PDF Optimization Shell 5.9.1.5 (http://www.pdf-tools.com)) First seen: 2025-02-08
MD5: 1b7ab9d44e5d3dbcd71d05ad8e31cf14 SHA-1: 4a42f107548d5b869e0e1a1d45fedb7bac3de1ba SHA-256: 25dc8558b2a97218a746fb86b370dc506ae8c678b137942c00da7d8e47e43bde
42 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pdf-tools.com In PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000c02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC02 17228 bytes
SHA-256: 992a3d6d600665b8ed93441d29f0ac085b0381138b2bfe07322127b405e2df0f
font_01_sfnt_off0000372b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x372B 25880 bytes
SHA-256: de3f7202896cd471eb3f692d227b7a7e7ca2633b574a6d6b6d9700f105b02863
font_02_sfnt_off00007061.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7061 17308 bytes
SHA-256: d65e0da78d8c8a184e59f4240e5cf69b7b3658dedac49d9826e2aa0f70204efc
font_03_sfnt_off00009afe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9AFE 26656 bytes
SHA-256: d528b9581862b5dffabd27e68909e84d39698f3749f5f94cd55de510096dd0f2
font_04_sfnt_off0000e4a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4A5 14200 bytes
SHA-256: 1bd13807197bece8e5ad4b52f45e30ad86e8405185b3b2962b472a1fcd1fef2d
font_05_sfnt_off0001063f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1063F 20492 bytes
SHA-256: 67b988893be020247f6ff5291875ac28088d4746eee9187f09fa3f70641d9844
font_06_cff_off00064868.bin pdf-font-stream PDF embedded font (cff) at offset 0x64868 3229 bytes
SHA-256: bce00ff1190a9fb7aadef68a7c1b188768605c830492eff3444592970019e187

Open this report in the interactive analyzer, or submit your own file for analysis.