PDF / .VIR static analysis report

Static analysis result for SHA-256 29c8bc413d9b2d32…

CLEAN

PDF / .VIR

110.1 KB Created: 2025-01-04 21:00:51 +00:00 Authoring application: mPDF 7.1.6 First seen: 2025-01-08
MD5: 40ff3fdb420e818a379bf9b1ba37d316 SHA-1: ec245358cc39ad9ec5d5945412356750107f9494 SHA-256: 29c8bc413d9b2d327be56bafc17dfb36619b932b2dd65e01c5589dc626d6cdff
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lowmp3.com/rock/53466-as-i-lay-dying-meaning-in-tragedy.html PDF link annotation
    • https://lowmp3.com/file.php?fn=QXMgSSBMYXkgRHlpbmcgLSBNZWFuaW5nIEluIFRyYWdlZHkgKE1QMyk%3D&a=cmFy&s=MTU4MSBtYg==&i=L2ltYWdlcy8xNy9hcy1pLWxheS1keWluZy1tZWFuaW5nLWluLXRyYWdlZHkuanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=QXMgSSBMYXkgRHlpbmcgLSBNZWFuaW5nIEluIFRyYWdlZHkgKEZMQUMp&a=cmFy&s=MTI5NiBtYg==&i=L2ltYWdlcy8xNy9hcy1pLWxheS1keWluZy1tZWFuaW5nLWluLXRyYWdlZHkuanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=QXMgSSBMYXkgRHlpbmcgLSBNZWFuaW5nIEluIFRyYWdlZHkgKFdNQSk%3D&a=cmFy&s=MTY0MSBtYg==&i=L2ltYWdlcy8xNy9hcy1pLWxheS1keWluZy1tZWFuaW5nLWluLXRyYWdlZHkuanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=QXMgSSBMYXkgRHlpbmcgLSBNZWFuaW5nIEluIFRyYWdlZHk%3D&a=bXAz&s=MTU4MSBtYg==&i=L2ltYWdlcy8xNy9hcy1pLWxheS1keWluZy1tZWFuaW5nLWluLXRyYWdlZHkuanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/electronic/238042-richard-davis-meaningin-the-air-remixes.pdfIn PDF document text
    • https://lowmp3.com/rock/227401-as-i-lay-dying-a-long-march-the-first-recordings.pdfIn PDF document text
    • https://lowmp3.com/folk-world-country/208387-arthur-d-life-can-have-meaninglittle-angel.pdfIn PDF document text
    • https://lowmp3.com/reggae/196036-the-heptones-gg-allstars-meaning-of-lifepart-two.pdfIn PDF document text
    • https://lowmp3.com/rock/193461-theatre-of-tragedy-theatre-of-tragedya-rose-for-the-dead.pdfIn PDF document text
    • https://lowmp3.com/hip-hop/143728-rzaeightballmjg-tragedyreason-forrhyme.pdfIn PDF document text
    • https://lowmp3.com/rock/124804-as-i-lay-dying-decas.pdfIn PDF document text
    • https://lowmp3.com/electronic/105532-spleenlife-is-not-a-tragedy.pdfIn PDF document text
    • https://lowmp3.com/rock/103808-as-i-lay-dying-shadows-are-security.pdfIn PDF document text
    • https://lowmp3.com/rock/69653-tragedy-tragedy.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_003_off00002669.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_003_off00002669.bin)
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00002669.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2669 19824 bytes
SHA-256: b5a056ebcfa63b81c85d4fd1ac3bc6fe76845c50664add9735242967184c2e9d
font_01_sfnt_off00005a38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A38 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00008e50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E50 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1

Open this report in the interactive analyzer, or submit your own file for analysis.