PDF / .VIR static analysis report

Static analysis result for SHA-256 25f42b9e592075e3…

SUSPICIOUS

PDF / .VIR

336.7 KB Created: 2023-04-01 18:39:54 Authoring application: pdf-parser First seen: 2024-10-26
MD5: 7ebc76c88d04457a77b54b215c8a6775 SHA-1: b272ba2e40183bb0d8c4c73637722fd3dfdaa264 SHA-256: 25f42b9e592075e393cad59887bdbefad6851bfd19d09d71e367af5318c66eae
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://network-protection-automation-guide-new.brittanygroundhouse.com/suruburovera.pdf In PDF document text
    • https://adservice.google.com.uy/ddm/clk/445204615;249060672;c;;%3F//lipido.nevermis.com/577.pdfIn PDF document text
    • https://adservice.google.com.pk/ddm/clk/295204063;122181591;w;;%3F//beginners-guide-to-solidworks-2016-level.siboxizoxu.cfd/509.pdfIn PDF document text
    • https://adservice.google.com.ph/ddm/clk/408405163;208572896;n;;%3F//deutz-bf6m1013ec-service-manual-pdf.gamesawoli.online/vobetovatidedoz.pdfIn PDF document text
    • https://world-history-semester-2-study-guide-ans.zigunobe.cfd/ximiwewepabupule.pdfIn PDF document text
    • https://why-is-there-a-number-on-my-chrome-icon.wifejijad.cfd/mepijakoromodabe.pdfIn PDF document text
    • https://relat-rio-simples-pronto-em-pdf.zutitedisu.cfd/320.pdfIn PDF document text
    • https://adservice.google.com.bz/ddm/clk/425484003;227454619;f;;%3F//snow-rider-unblocked-67.wilezopera.cfd/konowareg.pdfIn PDF document text
    • https://adservice.google.com.ar/ddm/clk/478229754;284365575;c;;%3F//2017-infiniti-qx60-owners-manual-pdf.rijabev.cfd/51.pdfIn PDF document text
    • https://gingerbread-man-story-printable-pdf.kapulemu.cfd/vuz.pdfIn PDF document text
    • https://lufewotorab.evileyecharm.com/36.pdfIn PDF document text
    • https://visedibi.classiccountry1390.com/86.pdfIn PDF document text
    • https://learning-the-art-of-helping-building-blo.bioerm.cfd/658.pdfIn PDF document text
    • https://skyfactory-4-guide-pdf.era-insurance.com/ragoxesovisezatu.pdfIn PDF document text
    • https://adservice.google.tm/ddm/clk/445204615;249060672;c;;%3F//livro-a-parte-que-falta-pdf-gratis.fefuvowuga.cfd/4.pdfIn PDF document text
    • https://adservice.google.la/ddm/clk/300948314;127869103;e;;%3F//mazifolopos.lumufof.cfd/652.pdfIn PDF document text
    • https://adservice.google.sr/ddm/clk/478229754;284365575;c;;%3F//gebareretip.natawali.cfd/xipufudura.pdfIn PDF document text
    • https://adservice.google.pl/ddm/clk/426382440;228185261;d;;%3F//safugev.kajefaw.cfd/papidoze.pdfIn PDF document text
    • https://adservice.google.tg/ddm/clk/448794861;252804937;a;;%3F//tomtom-one-user-manual-pdf.zesukul.online/nibebupuvawurezifapu.pdfPDF link annotation
    • https://adservice.google.gr/ddm/clk/478229754;284365575;c;;%3F//neweda.diveaway-fiji.com/nesopugireretus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00050f3f.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00050f3f.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00050f3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50F3F 15020 bytes
SHA-256: 6feabe9df81b1399b72b06465dc4eab421fc47018172befaa47efe7f200f1c28