PDF / .VIR static analysis report

Static analysis result for SHA-256 27c68944c49f0cd1…

SUSPICIOUS

PDF / .VIR

580.2 KB Created: 2023-05-03 01:30:03 Authoring application: Smallpdf Desktop First seen: 2024-09-20
MD5: 0d78464220be188aa2ac7718593320c1 SHA-1: 4ca1f24afe0a9a491881d9c7a8ccf0994cc4088f SHA-256: 27c68944c49f0cd11a55e5713ea8fce1de52829264f183d7b1938b5400cb7907
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5079

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bomagekir.yaguecf.com/basijexinedosezalo.pdf In PDF document text
    • https://sosutite.peykweb.com/gorepozojuwefanomozoxeru.pdfIn PDF document text
    • https://xukuzevani.chaosdev.org/kagijaredalubuwitole.pdfIn PDF document text
    • https://wuxilod.akgrafik.com/56488456330.pdfIn PDF document text
    • https://butalife.chaosdev.org/31618119748.pdfIn PDF document text
    • https://sotawavuje.ctrlproxy.org/29323347721.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/75cde431-b425-4447-a835-04ab019ab5e4/downloads/vw_caddy_maxi_life_weight.pdfPDF link annotation
    • https://img1.wsimg.com/blobby/go/d43c26f8-4246-4737-b7e0-5b156d1b4fad/downloads/80992954670.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/2fd4696f-c569-48ac-a0e4-875407c27bc1/downloads/sugugowenu.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f842bfc6b8a48c2a830a7c/65483ba4f033546e8f8a88bc_41187416552.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/75cde431-b425-4447-a835-04ab019ab5e4/downloads/tuvamasujefora.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0008bf79.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0008bf79.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0008bf79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BF79 10624 bytes
SHA-256: 203e2730431523566277a7c385bbac069afa22a975dba7cb22b7d98e249e5efa
font_01_sfnt_off0008d7f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D7F6 17012 bytes
SHA-256: 7ae0f077f8bb4f562c9f5b7bbf96a210d3b22f65f4b01f26b0156fd8ddbf7739

Open this report in the interactive analyzer, or submit your own file for analysis.