Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 36f2712fb2107130…

MALICIOUS

PDF / .VIR

3.56 MB Created: 2024-01-02 09:33:59 -05:00 Authoring application: Adobe InDesign 19.0 (Windows) (via Adobe PDF Library 17.0) First seen: 2024-04-14
MD5: 2efc025ea348b8216a7a2ca4905876d2 SHA-1: 6612b2361fc0598961eaa7b72bdfda917d22b254 SHA-256: 36f2712fb210713004ccac5d81c45b8ae6ee836da532d7d58c6c686f0e1a8b7e
248 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0008

Heuristics 11

  • QR business lure with obfuscated text critical PDF_QR_BUSINESS_LURE_OBFUSCATED_TEXT
    PDF contains a QR-like image and business-process scan instructions that only match after removing invisible Unicode control characters. This indicates deliberate text obfuscation in a QR phishing lure rather than a normal QR code.
  • QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
    PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
  • QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LURE
    Document asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
  • Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • ASCII85Decode filter (with exploit indicators) low PDF_FILTER_85
    ASCII85 encoding filter present alongside exploit delivery indicators — uncommon outside of obfuscation
  • PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
    The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.modular.org/ PDF link annotation
    • https://www.worldofmodular.org/In PDF document text
    • https://www.worldofmodular.org/speakers/In PDF document text
    • http://cipa.jp/exif/1.0/In PDF document text
    • http://ns.camerabits.com/photomechanic/1.0/In PDF document text
    • http://jenworley.comIn PDF document text
    • http://www.metadataworkinggroup.com/schemas/regions/In PDF document text
    • https://www.worldofmodular.org/exhibit/In PDF document text
    • https://www.worldofmodular.org/location/In PDF document text
    • http://ns.attribution.com/ads/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Font#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/In PDF document text
    • http://ns.adobe.com/hdr-gain-map/1.0/In PDF document text
    • http://ns.google.com/photos/1.0/container/In PDF document text
    • http://ns.google.com/photos/1.0/container/item/In PDF document text
    • http://ns.adobe.com/xmp/sType/Area#In PDF document text
    • http://ns.apple.com/faceinfo/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://www.extensis.com/meta/FontSense/In PDF document text
    • http://www.dji.com/drone-dji/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.