PDF / .VIR static analysis report

Static analysis result for SHA-256 3b650467a6883732…

SUSPICIOUS

PDF / .VIR

4.65 MB Created: 2022-09-08 10:47:19 +03:00 Authoring application: Microsoft® Word 2010 First seen: 2025-11-28
MD5: 9e07b276afa38aac6bcdea6badb9acde SHA-1: 4bee19c7cd1bc3076bb9565365b56045857cdbab SHA-256: 3b650467a6883732833277df13486e03ae37c850000b046e4ded0ec07688c719
26 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0040

Heuristics 4

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sci-conf.com.ua/xvi-mizhnarodna-naukovo-praktichna-konferentsiya-modern-directions-of-scientific-research-development-7-9-09-2022-chikago-ssha-arhiv/ PDF link annotation
    • https://sci-conf.com.ua/PDF link annotation
    • https://storage.decentralization.gov.ua/uploads/library/file/346/10.12.2018.pdfIn PDF document text
    • http://koveladm.gov.ua/In PDF document text
    • http://eco.voladm.gov.ua/category/all/locality=9In PDF document text
    • https://zakon.rada.gov.ua/go/2456-12In PDF document text
    • https://vodres.gov.ua/In PDF document text
    • https://sci-conf.com.ua/xvi-mizhnarodna-naukovo-praktichna-konferentsiya-modern-PDF link annotation
    • https://sci-conf.com.uaPDF link annotation
    • http://vinoge.comIn PDF document text
    • https://agrosphere.geIn PDF document text
    • http://fermeri.geIn PDF document text
    • https://sci-conf.com.ua/xiii-mizhnarodna-naukovo-praktichna-konferentsiya-science-In PDF document text
    • http://palanskaotg.org.ua/In PDF document text
    • https://vyshniv-rada.gov.ua/In PDF document text
    • http://lbsadm.gov.ua/In PDF document text
    • https://ustyluzka-In PDF document text
    • https://lvivgallery.org.ua/museums/muzey-zapovidnyk-oleskyy-zamokIn PDF document text
    • http://visitlviv.net/restaurant/ua/gridnicya/?section=gourmetIn PDF document text
    • http://grydnycia.com.ua/?fbclid=In PDF document text
    • http://itinery.com.ua/img/objects_content/%D0%BE%D0%BB%D0%In PDF document text
    • https://vnebo.ua/files/products/oleskiy_3_1200-800-6254a.1200x800.jpg.webpIn PDF document text
    • https://photos.drymba.com/drb/001/056/30616_cd6_ht8pm2.jpgIn PDF document text
    • https://comoco.eu/Castelo-de-Castelo-NovoIn PDF document text
    • https://zakon.rada.gov.ua/rada/show/v0641729-15#TextIn PDF document text
    • https://www.pdau.edu.ua/sites/default/files/node/4753/virtualnarealnist.pdfIn PDF document text
    • http://tme.umo.edu.ua/docs/Dod/1_2010/Gorbach.pdfIn PDF document text
    • http://grydnycia.com.ua/?fbclid=%20IwAR3G3NTIjgTddhq6Dg2rDjhMRHosgiHm_AZUwnZCMTqNJDoPSv8_kJUB3j8In PDF document text
    • http://itinery.com.ua/img/objects_content/%D0%BE%D0%BB%D0%25%20B5%D1%81%D1%8C%D0%BA%D0%BE-2.jpgIn PDF document text
    • http://www.history.org.ua/?termin=Rivnensko_Lutska_1944In PDF document text
    • http://dspace.onua.edu.ua/bitstream/handle/11300/1098/Lisakova.pdf?sequence=1&isAllowed=yIn PDF document text
    • https://www.de.digital/DIGITAL/Redaktion/EN/Publikation/digital-strategy-2025.pdf?__blob=publicationFile&v=9In PDF document text
    • https://www.the-village.com.ua/village/city/city-news/292641-yakiy-riven-tsifrovoyi-gramotnosti-ukrayintsiv-doslidzhennyaIn PDF document text
    • https://gtmarket.ru/files/research/global-competitiveness-index/Global_Competitive-ness_Report_2019.pdfIn PDF document text
    • https://www.bas-soft.eu/soft/bas-mass/bas-accounting/In PDF document text
    • https://dilovod.ua/In PDF document text
    • https://www.it.ua/In PDF document text
    • https://debet.com.ua/In PDF document text
    • https://uit.kiev.ua/perevagi-vikoristannja-hmarnoi-buhgalterii-bas-v-umovah-voiennogo-stanu/In PDF document text
    • http://nbuv.gov.ua/UJRN/Oif_apk_2018_3_6In PDF document text
    • http://zakon2.rada.gov.ua/laws/show/108-95In PDF document text
    • https://zakon.rada.gov.ua/laws/show/929_020#TextIn PDF document text
    • https://zakon.rada.gov.ua/laws/show/z0392-99#TextIn PDF document text
    • https://zakon.rada.gov.ua/laws/show/996-14#TextIn PDF document text
    • https://zakon.rada.gov.ua/laws/show/361-20In PDF document text
    • https://zakon.rada.gov.ua/laws/show/994_029#TextIn PDF document text
    • https://zakon.rada.gov.ua/In PDF document text
    • https://www.ukrstat.gov.ua/In PDF document text
    • http://www.iae.org.ua/presscentre/archnews/2912-instytut-ahrarnoyi-ekonomiky-prezentuvav-stratehichni-napryamy-staloho-rozvytku-silskykh-terytoriy-na-period-do-2030-roku.htmlIn PDF document text
    • http://zakon.rada.gov.ua/In PDF document text
    +64 more URL(s)

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_188_off003504a9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3504A9 452380 bytes
SHA-256: 27c9e226ed1d4c926ae4b3700922a430cd8d9956900f4e86c68b381c50cd3ef9
stream_190_off003a0943.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3A0943 412960 bytes
SHA-256: aa067beb2ff4cdb34fcaf9775e843d4e1ec25abc4168155f6894886124ef7ac4
stream_191_off003bf280.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3BF280 321304 bytes
SHA-256: d4f68a90f55af407bf922a0489b8850f38f00faeb56852a0ce0260d10b2933d1
stream_194_off003ffea5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3FFEA5 375596 bytes
SHA-256: 2a138fa8fa74b559eda05f5fd8bbd258cca0027866973491ffc40caa355feef3
font_01_sfnt_off003757b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3757B1 537988 bytes
SHA-256: 1353513270a633226b001a320ec20b828b104c33ea5bc3ec65cde038632ac8c1
font_04_sfnt_off003dfbef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DFBEF 291760 bytes
SHA-256: 78ea47301f2dcdc0e18aa916d0d743e498390c4de566ee69513a296c67379a95
font_05_sfnt_off003fa9f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FA9F9 33176 bytes
SHA-256: fae8f825f661e03bb862cd292286fc7e1c4f2964fcec00a4f8fd8b1bc6677bca
font_07_sfnt_off00415b8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x415B8E 4064 bytes
SHA-256: 237c078429d76e267900dbb8d97ec95512a8d8ad5a40bf03e0324b958a8ea094
font_08_sfnt_off00416502.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x416502 274260 bytes
SHA-256: 9e9fb11fb53114dffe97b6f3df80d21929281c225844ff993365e0c4a2d7b30d
font_09_sfnt_off00432211.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x432211 222088 bytes
SHA-256: 19c349721ed7a9ecab9dfee69bf116b9ec760084a1a484e00e2d1e8f032d784a
font_10_sfnt_off0044b72c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44B72C 536772 bytes
SHA-256: d91116d378346a152a51bf67963f16ab76f1ddfd23f3c9059dc84d8e9bab109e