Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 2f527b4f7e2b8f24…

MALICIOUS

PDF / .VIR

5.58 MB Created: 2026-06-12 11:10:33 -07:00 Authoring application: Adobe InDesign 21.4 (Macintosh) (via Adobe PDF Library 18.0) First seen: 2026-06-29
MD5: d1297bf10764191bcdfac1236bdf13d0 SHA-1: 4712867a9b91016b06f240f48469d6b6b1c77768 SHA-256: 2f527b4f7e2b8f2414fc36ab3711f9b7642b5f5e0261055b8dcf5e0eb9dc8707
146 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1157

Heuristics 7

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LURE
    Document asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ctk.church/bellingham PDF link annotation
    • http://cipa.jp/exif/1.0/In PDF document text
    • http://prismstandard.org/namespaces/prismusagerights/2.1/In PDF document text
    • https://cairographics.orgIn PDF document text
    • http://www.metadataworkinggroup.com/schemas/regions/In PDF document text
    • http://ns.attribution.com/ads/1.0/In PDF document text
    • https://www.typejockeys.comhttps://www.typejockeys.comhttp://typekit.com/eulas/0000000000000000774b976bRegularIn extracted file (font_04_sfnt_off0000b1de.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Font#In PDF document text
    • http://ns.google.com/photos/1.0/camera/In PDF document text
    • http://ns.adobe.com/xmp/note/In PDF document text
    • http://ns.adobe.com/hdr-gain-map/1.0/In PDF document text
    • http://ns.google.com/photos/1.0/container/In PDF document text
    • http://ns.google.com/photos/1.0/container/item/In PDF document text
    • http://ns.adobe.com/xmp/1.0/DynamicMedia/In PDF document text
    • http://purl.org/dc/terms/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://ns.acdsee.com/iptc/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://www.dji.com/drone-dji/1.0/In PDF document text
    • http://ns.microsoft.com/photo/1.0In PDF document text
    • http://ns.adobe.com/xmp/sType/Area#In PDF document text
    • http://ns.apple.com/faceinfo/1.0/In PDF document text
    • http://www.aiim.org/pdfua/ns/id/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off00005596.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 29

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_055_off0018394e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18394E 30856 bytes
SHA-256: 0f63cb1a1cc2144b1775d61111405dc28d007fbb217ce7f45e014add4ff3e1ba
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.43, consistent with packed or encrypted content.
stream_109_off00283e80.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x283E80 1327326 bytes
SHA-256: 1d61008a146648e75b547b0b93571f2d08b244b2e98934f1923f2785d0158b6e
icc_00_off00005596.icc pdf-icc-profile PDF ICC profile at offset 0x5596 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00005ffb.bin pdf-font-stream PDF embedded font (cff) at offset 0x5FFB 5992 bytes
SHA-256: 34bb33e9a2bb6fd40bcfd405a13a576832e5b93c187b4431659dfdceae5c83ed
font_01_cff_off00007359.bin pdf-font-stream PDF embedded font (cff) at offset 0x7359 6059 bytes
SHA-256: dd2f0ea0eaf2bede972dd2bcafb8236c2d2c32657209e6c2ed96a8731873bed6
font_02_cff_off000086b8.bin pdf-font-stream PDF embedded font (cff) at offset 0x86B8 8016 bytes
SHA-256: 26bb0cbebcf2181bd475b46d090fd1a399301b95cd63537d3ab1bcecc5303c51
font_03_cff_off0000a01c.bin pdf-font-stream PDF embedded font (cff) at offset 0xA01C 5440 bytes
SHA-256: 3c4115c865ff8768d73249eb9fb2d427e9e13a7c8171bd69dd8f9bc7d24f907f
font_04_sfnt_off0000b1de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB1DE 25401 bytes
SHA-256: 83279d8b39f90555fd0e28530a8ab585c2bad0424e695050222389d840d77355
font_05_cff_off0000e20e.bin pdf-font-stream PDF embedded font (cff) at offset 0xE20E 3470 bytes
SHA-256: 7a6f5247a00bd8a93a9d8a385b6fbd4eb4b3be9c5fbad3746a6993b0a8544a77
font_06_sfnt_off000137d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137D4 22185 bytes
SHA-256: 4a91debf22d3c334d377717b420485aee376efdf584fd0fb07988b248c556b4a
font_07_cff_off00085246.bin pdf-font-stream PDF embedded font (cff) at offset 0x85246 1323 bytes
SHA-256: 0e8472dbf5205b7c5ed5b93651cebc4a46fab47dd94531691f4f521a8929c61d
font_08_cff_off003002df.bin pdf-font-stream PDF embedded font (cff) at offset 0x3002DF 41687 bytes
SHA-256: 296d217366f7844f1b3ce9608e16582f75a6d523b4321a814aad26ae6e27a65b
font_09_cff_off003071dc.bin pdf-font-stream PDF embedded font (cff) at offset 0x3071DC 23130 bytes
SHA-256: aa401ce08a7d77180e1ebbd43a0edfa671d93b561fc5992c6d61b5a45925cf5b
font_10_cff_off0038da8f.bin pdf-font-stream PDF embedded font (cff) at offset 0x38DA8F 1002 bytes
SHA-256: 627cc0e81dc369029e5fb615d3c5ad376e22274cbf8517343df75b6152340aba
font_11_sfnt_off0038e0ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38E0FF 8844 bytes
SHA-256: 39db33fb5fe6fd6b84622398df0c4670fe5db040df5f2a2f6d663750a24d4a6b
font_12_sfnt_off00492f87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x492F87 21123 bytes
SHA-256: 84d4ed0cf8526148532ff5d42c051bf7605df2087235307d4c13989e33b4a214
font_13_sfnt_off004ca6fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4CA6FC 23919 bytes
SHA-256: 39946ec41d247f1c2165d95c585b63861feff5cda610cd01d759cbc64c4e3adb
font_14_sfnt_off004f48b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F48B1 24447 bytes
SHA-256: c281277be6160d48fd2f7200184e9899f69e7faff6b6be24052594f229ee81e0
font_15_cff_off00551614.bin pdf-font-stream PDF embedded font (cff) at offset 0x551614 6952 bytes
SHA-256: 6ac847a7ea76e02f8d2c1b972b4dd7931a8fb42b0ea1f70236e9d52abbe6a6e1
font_16_sfnt_off00552ff0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x552FF0 21075 bytes
SHA-256: 2da75485f2f9bdb8f4ee1c9493a3920cbc7ea1ab174da26d720ef8faa9f45ea9
font_17_sfnt_off00555c36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x555C36 24247 bytes
SHA-256: 819f8360b8ef6cec93100fe2556c6a6b2c1307dad612e91e3dc3a0487dc1c6dd
font_18_sfnt_off0055929a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55929A 29815 bytes
SHA-256: edf93fbb3256e02cc9f02b8205d1907dd9aa58852a28200596cdf138b4c3740d
font_19_cff_off0055d343.bin pdf-font-stream PDF embedded font (cff) at offset 0x55D343 2873 bytes
SHA-256: e25c49c1c301e62371767f33bc9dc08e39113502108b150ab1ded505e3044702
font_20_sfnt_off0055ea64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55EA64 28327 bytes
SHA-256: a5668d7a2e8c3a4957b6dbcd35bac296f7e772a6f780154e6249dda5f6f31e4b
font_21_cff_off00562d8a.bin pdf-font-stream PDF embedded font (cff) at offset 0x562D8A 7177 bytes
SHA-256: 50a69fde69b452e74357c2855d9eb909f3eedbe451e399d48faf2b73d6b42d5c
font_22_sfnt_off005649b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5649B4 26785 bytes
SHA-256: 67641cb3721ddd4d40dc6a698435727b0ee7840cfc858df9aa0efa7a256e476c
font_23_sfnt_off00568324.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x568324 26207 bytes
SHA-256: 2288e984fc2fc03f8da7dfb7b96d56058ca6364973757006d22b92b187be718f
font_24_cff_off0056cbb1.bin pdf-font-stream PDF embedded font (cff) at offset 0x56CBB1 4605 bytes
SHA-256: d965174b5c1ab689d53c6b3ee1cc02dd6b358e912682163c3b421a932d9f6e88
font_25_cff_off0056f740.bin pdf-font-stream PDF embedded font (cff) at offset 0x56F740 1826 bytes
SHA-256: 5cf57698deca6e609f56eb78a9813dcf06ae80a89c813030188f02ea45d75178

Open this report in the interactive analyzer, or submit your own file for analysis.