PDF / .VIR static analysis report

Static analysis result for SHA-256 324db1eddf659a9d…

CLEAN

PDF / .VIR

1.65 MB First seen: 2024-07-29
MD5: f387cc512359c6f1db0a71defc6dc8b4 SHA-1: 92e56734839795f5ff8fcba778b7605feabc5607 SHA-256: 324db1eddf659a9d7cdb32b976f176fd085f779eef02f1e41ae7f9b0ce9436ad
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.color.org In PDF document text
    • http://www.color.org)/S/GTS_PDFX/Type/OutputIntentIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.npes.org/pdfx/ns/id/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_041_off000402df.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x402DF 1829077 bytes
SHA-256: 128dc02f7246cc3807af0323695379f64151a8f27a587736acc59f8b6ce894b8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.73, consistent with packed or encrypted content.
font_00_cff_off00000e5f.bin pdf-font-stream PDF embedded font (cff) at offset 0xE5F 6650 bytes
SHA-256: e9f568915f4bcdd3c4498b0339e47ad6f182ce107052608c2fb161360e96da8b
font_01_cff_off0000273d.bin pdf-font-stream PDF embedded font (cff) at offset 0x273D 4570 bytes
SHA-256: ffa6f18a884291bdd6244b93878158078c3811d21554f18bd130b5e307424a78
font_02_cff_off00034151.bin pdf-font-stream PDF embedded font (cff) at offset 0x34151 2437 bytes
SHA-256: 4270f499bb223151f10e189aec6ad7d247ea3858a9dd4d8a44fe8b7144e07db5
font_03_cff_off0003d37a.bin pdf-font-stream PDF embedded font (cff) at offset 0x3D37A 4291 bytes
SHA-256: f73ad02f4160b12f995372547f2df5bdc4fb62242939fce2a9d7dacc4f98bd38
font_04_cff_off0003e450.bin pdf-font-stream PDF embedded font (cff) at offset 0x3E450 1790 bytes
SHA-256: 04dac33dbbc94a1e121c2f6173755ce8799082a0bf10ba4034d4e819421de2d3

Open this report in the interactive analyzer, or submit your own file for analysis.