PDF / .VIR static analysis report

Static analysis result for SHA-256 34b27393e5675d2e…

CLEAN

PDF / .VIR

890.0 KB Created: 2019-11-05 17:18:21 +01:00 Authoring application: Adobe InDesign 14.0 (Macintosh) (via Adobe PDF Library 15.0) First seen: 2024-12-23
MD5: 19baa94f8ca3a60d0cb02caf9287d959 SHA-1: 052dd2db4e064da6218ce4d52e94d7d600d0520e SHA-256: 34b27393e5675d2e7d6202e0121667ba4bec6617379c4b238d6c667dc1809a43
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cipa.jp/exif/1.0/ In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000c65.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC65 654352 bytes
SHA-256: da2b9b593e27cba2563cbc8596071c5c8f2395d3dbb4434538bac2bc9d58ce77
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
stream_024_off000d9a38.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD9A38 4395 bytes
SHA-256: 244d16c2cfb5a0a5af999509001ae83ab1fe400e5ecdfe56c4c2caa0fdab704d
font_00_cff_off000790eb.bin pdf-font-stream PDF embedded font (cff) at offset 0x790EB 1268 bytes
SHA-256: 2b7cc76733976544352693af0defc82b1d8727be532c819b573034468bccc004
font_01_cff_off0007a07e.bin pdf-font-stream PDF embedded font (cff) at offset 0x7A07E 1212 bytes
SHA-256: 4ff0d1b7818dd4b337e38ce6515176f6ef99ac8fd1a066d88de82d0ebcc057b7
font_03_cff_off000dab5b.bin pdf-font-stream PDF embedded font (cff) at offset 0xDAB5B 5243 bytes
SHA-256: 03565e781e8699d82f43318314858c1d6a59f1feb648282594242f234e152827
font_04_cff_off000dc9dd.bin pdf-font-stream PDF embedded font (cff) at offset 0xDC9DD 4867 bytes
SHA-256: addb11606a5243b72a427013836e685891b2d8316cffebb3fb21f2bbc927ad36

Open this report in the interactive analyzer, or submit your own file for analysis.