PDF / .VIR static analysis report

Static analysis result for SHA-256 2ca9c37cd5c27f98…

CLEAN

PDF / .VIR

577.5 KB Created: 2021-08-27 16:34:02 UTC Authoring application: Preview (via macOS Version 10.15.1 (Build 19B2106) Quartz PDFContext) First seen: 2024-11-21
MD5: 92dcb4f3e566a7e495948978fc202a76 SHA-1: 332c4664f9dae8694fb3292790f92c96bc317fc5 SHA-256: 2ca9c37cd5c27f9848b8a6692f2dede534aae0b8a1b62f0226fd76c3b988c9fc
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 3

  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.iec.chIn extracted file (icc_01_off000733c5.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 32

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off0000004e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E 59739 bytes
SHA-256: 67c1ea1bb28054e7463e93cde2967591305a4cb4fcae7641ae916ab48d68719e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
stream_012_off0000b7e8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xB7E8 18606 bytes
SHA-256: a4d51c8a0b04a63942f091eb04ef3e60a8983f464b8c726410c99f3dcd8a665f
stream_020_off000116fb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x116FB 12404 bytes
SHA-256: 0c377e3e278710a341b9c197178fc725024a20a9ce14e287b89bf7340944b194
stream_030_off0001c2d3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C2D3 44650 bytes
SHA-256: cd23babcce7366796b209a96636689a93c270af1194012f74eccfac9839e9fb4
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
stream_034_off0002bef0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2BEF0 44885 bytes
SHA-256: 344725722e3422421edd11db82348dd867c8f33060008dd150b2b2e0213dcc37
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
stream_041_off00044273.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x44273 45018 bytes
SHA-256: 5f086481cd6a8c1675079d9d1851e990e8f36bc9f7433936e07a478a7442a764
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
stream_045_off000513eb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x513EB 44993 bytes
SHA-256: a424dccf1986fc0fca7b4a97543a16f0d5bf506d4d1ea384344779081c9ed3f5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
stream_049_off0005e40b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5E40B 45057 bytes
SHA-256: ba851be8c999a473da5cf847be062cbaed0193a0c915b89fa4295ed90472c93f
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
stream_053_off0006b7e5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6B7E5 44484 bytes
SHA-256: a21a403a25ece71b7a15a805105d54a03e42107cdb166af332af32923e439eab
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
icc_00_off00005090.icc pdf-icc-profile PDF ICC profile at offset 0x5090 4456 bytes
SHA-256: ee2f821d16d12ec9e9f2958ac8865f40912d0ce1fb9625a31b594fab942b1caf
icc_01_off000733c5.icc pdf-icc-profile PDF ICC profile at offset 0x733C5 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off000072cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72CD 16340 bytes
SHA-256: b86461516d8a88cbdb264ad2631a53d23e7020b35f1e50a84b5a62361e7c8ad3
font_01_sfnt_off00009569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9569 6097 bytes
SHA-256: 9e3366a344f8f375d13e515af2888e6939a6de0482eea0ef64b8376f9e04129e
font_02_sfnt_off0000a4b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA4B8 6393 bytes
SHA-256: 0c2292a8a764ab28f037cd8e2e2202039a865e99c36d33f59afefebe7562cb43
font_04_sfnt_off0000e1ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1ED 12639 bytes
SHA-256: 68164ec3f100a9c16b9af2ca37563b27385b02cf7a4c4d1ffa418d76db4a2ea5
font_05_sfnt_off0000f97b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF97B 3124 bytes
SHA-256: 6861bfa87b3d13df0bf052974a12baf80312e23060592c579e06cbf6c709f31a
font_06_sfnt_off00010505.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10505 7260 bytes
SHA-256: c1157e3e70771fe3e1e04d91a2c1e9206ec5ed79bd5e4bb4be184cf3ff34e651
font_08_sfnt_off000134a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134A5 13312 bytes
SHA-256: ebf32b8c271a737375a45950f5668a7595506dba5fe64772c8db5d26aacc75b2
font_09_sfnt_off000159dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x159DC 3124 bytes
SHA-256: 6c15d3e69bdf6b983fe465a72ba672cc906fb5a699bc195774d2c9587e8e61db
font_10_sfnt_off00016731.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16731 12148 bytes
SHA-256: 1a2d0180ecde7e5342adea0fc35ae08f392a3fa8810087f9b07b5b044abfa314
font_11_sfnt_off00018573.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18573 7760 bytes
SHA-256: 5c512673a35c2e2536c675443e3d6f0b92debf6230b26016808504720d37e651
font_12_sfnt_off0001975b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1975B 8176 bytes
SHA-256: c7f480cffa252146513f135b97c4516dd231e66ab0404fc2d861a0b18c7ae4c2
font_13_sfnt_off000243a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x243A6 63223 bytes
SHA-256: ea581806c9d6391ea7b816b46f6af3aaf244ef0fbfd1cff8ca5984de6ea2e251
font_14_sfnt_off00033fcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33FCF 57591 bytes
SHA-256: cc761dd1d05f05586574f3bfb47385bb7c903d3af50c937439d5e4d0818c6492
font_15_sfnt_off0003de16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DE16 57123 bytes
SHA-256: 6aa7c467e9f95f4daf513a817f5e9c77ca91df22fd086a768af98566a4354499
font_16_sfnt_off0004c32e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C32E 49183 bytes
SHA-256: 1089a0d30d2e53eda385f6f6c9d9a79e71a763473313a5b02e8b57bfb80775d6
font_17_sfnt_off0005947c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5947C 48871 bytes
SHA-256: 53e97be2a3b2309407a14eee773d423ff0da38a26156a2fe2c3f3c4f0247b83d
font_18_sfnt_off00066572.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66572 50349 bytes
SHA-256: 16b8f67fcda0f92118a6fda1e2ae22a2756558624769c42c6414f006259a2614
font_19_sfnt_off000759d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x759D1 4280 bytes
SHA-256: 5c2653a885d7d7b6792751fef608c26f98bc06f4cbfdec4b752ad8274cc9a561
font_21_sfnt_off0007ad3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AD3E 4532 bytes
SHA-256: 7982827b4e7a234a0892d37fbcb6ce7c53a7e96ca68c54076c99b420daa60a4b
font_23_sfnt_off00084373.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84373 3204 bytes
SHA-256: 185878b73b77dae9b1e487adac0df34af0fb14407fb9f8a0efa1de6b9adc3294
font_25_sfnt_off00087087.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87087 2448 bytes
SHA-256: 9e8691861e5c58b3f518955233060fe024cd3ea19d094a235b8cb9d775ed929c

Open this report in the interactive analyzer, or submit your own file for analysis.