Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 384511ac72894f30…

MALICIOUS

PDF / .VIR

713.5 KB First seen: 2024-04-14
MD5: 85352ea6fe54052c046ec0c9b43c9de0 SHA-1: 48a62c4767422a88dacb1f180a0456fc71173ec5 SHA-256: 384511ac72894f30dafac3772240d7732d23f2dc583fb49580ea2e3c7d11bfe3
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monmouth.army.mil/C4ISR/faqs.htm In PDF document text
    • http://www.monmouth.army.mil/historian/pubupdates/Fort_Monmouth_and_theIn PDF document text
    • http://aec.army.mil/usaec/cultural/nhc_04.docIn PDF document text
    • http://aec.army.mil/usaec/cultural/nhc_03.docIn PDF document text
    • http://www.monmouth.army.mil/C4ISR/vaclinic.shtmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_054_off0008004a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8004A 20800 bytes
SHA-256: f58361d219088d9b4baaea3a1073dc09f8f9ee5e47bb24c1dec8030945d3003a
font_00_cff_off0000183d.bin pdf-font-stream PDF embedded font (cff) at offset 0x183D 1617 bytes
SHA-256: 4613fbb182a0911733879a0a90251526ca11daa7ed7830b384876f588a311859
font_01_cff_off00001e69.bin pdf-font-stream PDF embedded font (cff) at offset 0x1E69 8037 bytes
SHA-256: 63d2f8478c6a8a11c96089f6b98247a2080a188424645442256f1b6d8e514435
font_02_cff_off00003711.bin pdf-font-stream PDF embedded font (cff) at offset 0x3711 5196 bytes
SHA-256: 7d536461e3393915a67e7df278e05a95c358f25cc16412ba43f8f6f0f69fa99a
font_03_cff_off0000969c.bin pdf-font-stream PDF embedded font (cff) at offset 0x969C 1073 bytes
SHA-256: 4aa7baa1683baa8b555cddd8d2979fd06cbba028b39aedb87bb3b6c9cab73ac9
font_04_cff_off0007c50b.bin pdf-font-stream PDF embedded font (cff) at offset 0x7C50B 1023 bytes
SHA-256: f9cbe0a032bf17922c9da88cf65f5f7384dd84b4370fa511144db11b097631c8
font_05_cff_off000a8c97.bin pdf-font-stream PDF embedded font (cff) at offset 0xA8C97 8145 bytes
SHA-256: 2aa828c943f3762644f640244533a35e6cdd24f9764c859f0b3548340b938841
font_06_cff_off000aa69e.bin pdf-font-stream PDF embedded font (cff) at offset 0xAA69E 6609 bytes
SHA-256: dadc1466582bca7face1cd8d5a62a19eda77dd61dce07e9ecf7ec6f9bba6d7e9
font_07_cff_off000abc12.bin pdf-font-stream PDF embedded font (cff) at offset 0xABC12 5904 bytes
SHA-256: 73272b169d3e9df5ee2d896f305c5ea9302413f1378cf8a0828fceb85e50a03f
font_08_cff_off000acea5.bin pdf-font-stream PDF embedded font (cff) at offset 0xACEA5 3411 bytes
SHA-256: ce2f7f8dada1e23641fa3c108938e2e9629c6eba2051ae717e1c7967b8a98532
font_09_cff_off000ad9b2.bin pdf-font-stream PDF embedded font (cff) at offset 0xAD9B2 5050 bytes
SHA-256: 06cab96470bafb9c58c0f0be80c23d5ba253b01c006db57e8db06d13b482b00e
font_10_cff_off000ae995.bin pdf-font-stream PDF embedded font (cff) at offset 0xAE995 8753 bytes
SHA-256: 1b4670cfec6ed20671224387765affaecfc8b1f51bee81ba9edf17df304c3750

Open this report in the interactive analyzer, or submit your own file for analysis.