PDF / .VIR static analysis report

Static analysis result for SHA-256 2845219cd1688a95…

SUSPICIOUS

PDF / .VIR

27.7 KB Created: 2021-06-01 11:24:59 UTC Authoring application: Softplicity First seen: 2025-01-08
MD5: 38187747c68f51c220455b397b13824f SHA-1: c4a8b6da990bbae0742b0b0e9e07cb4d32d4fd3d SHA-256: 2845219cd1688a95e254d53dbd8f5ae49eb1d602e061cd25146213d5bdd2d44d
34 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3249

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5256927/normal_60b30c5763cd4.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5256865/normal_60b3036f856d1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fad17bf68.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256857/normal_60b3016f68e47.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256882/normal_60b3058991e76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256846/normal_60b305cd87a07.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256882/normal_60b302fe587ff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256864/normal_60b3045a5602d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5f6c1becbc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fcbe12708.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fccf255c2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fce05f4b9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fc8b33b59.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5f637d2b75.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fbc13b241.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fcad11b0a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5262587/normal_60b5fc9c0f318.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256865/normal_60b3057a25766.pdfIn PDF document text
    • http://gul.lods.icu/dls.php?q=Nissan+E25+Manual+1996+ModelIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.