PDF / .VIR static analysis report

Static analysis result for SHA-256 39e3f99282f7ee08…

CLEAN

PDF / .VIR

150.1 KB Created: 2009-10-09 11:06:05 -07:00 Authoring application: Adobe InDesign CS4 (6.0.4) (via Adobe PDF Library 9.0) First seen: 2024-05-12
MD5: b1f3bc543b0edbc4fbcd15a2cc8f29dd SHA-1: a318d634f9b4ecdcc22b758841eb9f3f182af76b SHA-256: 39e3f99282f7ee08986d18a13b79ef17704f4a6227b20bf14ef86a6338766281
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • PDF paints image(s) but contains no text operators info PDF_IMAGE_ONLY_LURE
    PDF has 2 image XObject(s) and the content stream contains no text-emitting operators (BT/ET, Tj, TJ, ', ") in either raw bytes or decompressed streams — this is the screenshot-as-PDF pattern used to bypass text-based scanners and to deliver instructions purely through rendered pixels. It is informational unless paired with invisible links or risky URI context.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://ns.adobe.com/xmp/InDesign/privateIn PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off000067f0.icc pdf-icc-profile PDF ICC profile at offset 0x67F0 560 bytes
SHA-256: 07fa839e652279252d78da0572b3f11411c3c1a21a18430aa814b93574725b08
font_00_cff_off00002faf.bin pdf-font-stream PDF embedded font (cff) at offset 0x2FAF 5609 bytes
SHA-256: 2f38217a5479bf31a5609e0de01e709f960a82b8e2758ea3c25600b3df370cb5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
font_01_cff_off00004939.bin pdf-font-stream PDF embedded font (cff) at offset 0x4939 2577 bytes
SHA-256: 30a1f802c5194a4864d928a429386f87f8ce4bafcba3182b8b5b14102fa8bce9
font_02_cff_off0000568a.bin pdf-font-stream PDF embedded font (cff) at offset 0x568A 3412 bytes
SHA-256: 9e427eb9551e44dd00ca807a3ee517e5856ebbe8bda0cbe6dc10d09896aaf6e5

Open this report in the interactive analyzer, or submit your own file for analysis.