Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 395d3d3b597b0e68…

MALICIOUS

PDF / .VIR

815.5 KB First seen: 2024-04-14
MD5: 066575a56e7681f9e0ab6e72a4d5f504 SHA-1: e4d72c835f98ac05422273b79ae224b543d82839 SHA-256: 395d3d3b597b0e68faaa0df5b65c7093b52a7dcbcd24b08b379f5ea11aaceb45
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.Linotype.com/http://www.linotype.com/fontdesignersCharacter In extracted file (stream_075_off000acad2.bin)
    • http://diversity.utexas.edu/disability/In PDF document text
    • https://www.facebook.com/UTAustinServicesForStudentsWithDisabilitiesIn PDF document text
    • https://www.tdlr.texas.gov/ab/ab.htmIn PDF document text
    • http://diversity.utexas.edu/disability/forms-and-documents/In PDF document text
    • http://diversity.utexas.edu/disability/using-accommodations/In PDF document text
    • http://diversity.utexas.edu/disability/deafhh/In PDF document text
    • https://diversity.utexas.edu/disability/placement-exams/In PDF document text
    • https://diversity.utexas.edu/disability/housing/In PDF document text
    • https://registrar.utexas.edu/students/registrationIn PDF document text
    • http://www.policies.utexas.edu/policies/nondiscrimination-policyIn PDF document text
    • http://diversity.utexas.edu/disability/facultystaff/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_013_off00006dad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6DAD 3836 bytes
SHA-256: 594b1898c209fc012d0b1d9e09e8243188973c484b9924eef2c8c305b1950ea8
stream_075_off000acad2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xACAD2 58651 bytes
SHA-256: 60a5dfe275a00ba085fbc457a1f2a45056a962e220f4b5926af70c3fede985ce
font_01_cff_off00007b17.bin pdf-font-stream PDF embedded font (cff) at offset 0x7B17 4764 bytes
SHA-256: cd1829dfcb39fe86f7dbad35c94b6123fefe5ddc7a944fbf228a2b77e46ecae2
font_02_cff_off0007e871.bin pdf-font-stream PDF embedded font (cff) at offset 0x7E871 2912 bytes
SHA-256: 499cc32939ca86d1f193d5b969a9607b782c804c37e6c712dd90518668af1343
font_03_sfnt_off000a5e59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA5E59 31173 bytes
SHA-256: bbd412073f66e0968871832b6f9be64265c6a9720eeb7320975c4a05808c7bb2
font_04_sfnt_off000a8d0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA8D0C 25838 bytes
SHA-256: c25dd954f9d6069fc4ebfe6b654dcf60ab69c16b38db555f0deb8f53191721c6
font_05_cff_off000ab0ce.bin pdf-font-stream PDF embedded font (cff) at offset 0xAB0CE 1171 bytes
SHA-256: 275c3b557b31793a4c18305a5c7e0e537855abc3a9d8ac0122301b6baada1fc4
font_06_cff_off000ab6ca.bin pdf-font-stream PDF embedded font (cff) at offset 0xAB6CA 1017 bytes
SHA-256: 96cb81c77950b89da3bb1015f5c4422fc016a17e8249d3b239cec1cfb03ea345
font_07_cff_off000abc19.bin pdf-font-stream PDF embedded font (cff) at offset 0xABC19 3495 bytes
SHA-256: 900f8963f18d1673163820e6c8f48801be92d5a3f591eca3aa1544ea77a593e1
font_09_cff_off000ba3fd.bin pdf-font-stream PDF embedded font (cff) at offset 0xBA3FD 2236 bytes
SHA-256: cac8f3eaaab3e389a82a5fef417eb1f4aadf63dc953ed8b831eab7d00d015177
font_10_cff_off000baf2c.bin pdf-font-stream PDF embedded font (cff) at offset 0xBAF2C 4655 bytes
SHA-256: b26300ceefbbaac49112bd3a1af21e58e2bf6ccebe0135ef9de1c0aeef773af2
font_11_cff_off000bbede.bin pdf-font-stream PDF embedded font (cff) at offset 0xBBEDE 4217 bytes
SHA-256: 4193447d11274775865ff8b27159a1dd26801e10f02e562a3e738a9c90bc3b9d
font_12_cff_off000bccc0.bin pdf-font-stream PDF embedded font (cff) at offset 0xBCCC0 5044 bytes
SHA-256: 9cf1db033c0502f5fc17a4ee34c90a8a609b347e8498501e61c353210ea0e981
font_13_cff_off000bddab.bin pdf-font-stream PDF embedded font (cff) at offset 0xBDDAB 5464 bytes
SHA-256: e6e3eb4d28f3a6ec91e2042c44a308f03123f39bd2330eb7c9eea0bdb82572d9
font_14_cff_off000bf976.bin pdf-font-stream PDF embedded font (cff) at offset 0xBF976 2953 bytes
SHA-256: d2c2c27a1c5fe4ca4e7ab07b0001a293c4586b6bbca7a462087b1170726724a2
font_15_cff_off000c058d.bin pdf-font-stream PDF embedded font (cff) at offset 0xC058D 3103 bytes
SHA-256: f07e9af36ad5d879d773127d5f4f3ed4b7fe264102d2044fce69e4ecfb1f116b

Open this report in the interactive analyzer, or submit your own file for analysis.