Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 3df947263f5c40cc…

MALICIOUS

PDF / .VIR

4.19 MB Created: 2025-03-04 13:04:05 UTC Authoring application: Adobe InDesign 19.1 (Windows) (via Adobe PDF Library 17.0) First seen: 2026-07-17
MD5: 02de38078096cb76f9f02d0c6a4a1700 SHA-1: 4630853a69e0792e729c836f6ec067ed5d95e341 SHA-256: 3df947263f5c40ccbb022f5d903822f8de0b47c36f7af32fa1ebea2a023b0445
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a high number of streams, suggesting obfuscation. It exhibits a critical heuristic for a travel-support phone-number stuffing scam, with 14 phone numbers and extreme repetition of content. The document body appears to be a progress report, but the embedded URLs and the heuristic strongly indicate a social engineering attempt to trick the user into contacting a fraudulent support line.

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 3

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.neic.ie/ In PDF document text
    • https://www.neic.ie/publicationsIn PDF document text
    • http://ns.fotoware.com/iptcxmp-custom/1.0/In PDF document text
    • http://ns.fotoware.com/iptcxmp-reserved/1.0/In PDF document text
    • http://cipa.jp/exif/1.0/In PDF document text
    • http://www.metadataworkinggroup.com/schemas/regions/In PDF document text
    • http://ns.attribution.com/ads/1.0/In PDF document text
    • http://ns.camerabits.com/photomechanic/1.0/In PDF document text
    • https://github.com/googlefonts/OswaldFont\)/FSTypeIn extracted file (font_05_cff_off003d7521.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.microsoft.com/photo/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/In PDF document text
    • http://xmp.gettyimages.com/gift/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://iptc.org/std/Iptc4xmpExt/2008-02-29/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xmp/sType/Area#In PDF document text
    • http://ns.apple.com/faceinfo/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xmp/1.0/DynamicMedia/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off00003716.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_021_off000391ea.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x391EA 14742 bytes
SHA-256: 9fefeaf8d21e963d0ca0b9411e6edacd0f5a9012fae588b8b545d75d735752a8
stream_023_off0003b789.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3B789 13922 bytes
SHA-256: 545ce3d6ae90c501617d6474d1e8151f1e8f4892a4a56becd69c2831d51e600d
icc_00_off00003716.icc pdf-icc-profile PDF ICC profile at offset 0x3716 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off00004184.bin pdf-font-stream PDF embedded font (cff) at offset 0x4184 4755 bytes
SHA-256: 77c4602f754eb12e968753615cfcc536414d472c42a366ab3d27cdb423ac1ab6
font_03_sfnt_off0008354e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8354E 17431 bytes
SHA-256: 8bdf9fc8e72de76bf8c1f522ed8bd97be887e8c729b82a87805c14deb8fa89af
font_04_sfnt_off001e7f88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E7F88 14416 bytes
SHA-256: acbde57e1178c150fd57df9462c895a0e937bd12ed9dc5e8bf14b314f573eded
font_05_cff_off003d7521.bin pdf-font-stream PDF embedded font (cff) at offset 0x3D7521 1824 bytes
SHA-256: f914224df76315e7766b42af352a389d7cfb23f5b49497542fc277f8b444a0e3
font_06_sfnt_off004142b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4142B3 11586 bytes
SHA-256: 692b210d6003c7b46fa8322cf1e5badc014f0e214092122e2f759d088cf3e7bc
font_07_sfnt_off0041661a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41661A 18925 bytes
SHA-256: f16c7067a8c10ff7d782577cd66c58838fdda86828c44c880ad0e6a2d9a1d49a
font_08_sfnt_off00419399.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x419399 20272 bytes
SHA-256: 87fb05c930b9c45c2dfb1de242a3e6dfb769023479a71641bfc3be96ee92a45c
font_09_sfnt_off0041cf3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41CF3E 17434 bytes
SHA-256: 872eb0f6dc10322f0b0a2fea5ffdad51c612b5165ff3b5c426df8d83b6f2b641
font_10_sfnt_off0041f8b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41F8B7 22839 bytes
SHA-256: 40cd4a0100d8a4b2512ad304f76680c00049c5120a819ef4129dc1c045b62429
font_11_cff_off00423768.bin pdf-font-stream PDF embedded font (cff) at offset 0x423768 4518 bytes
SHA-256: eb61aa71019cc88b434ad62eb9aa1d283bb61fd8b3a6439a4ced199049fb3525
font_12_sfnt_off00425549.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x425549 15201 bytes
SHA-256: 19b0f958f0e06fa239a8a742b514089ba59fbccb54aa045e15d72539ea569120
font_13_sfnt_off004284cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4284CD 17579 bytes
SHA-256: 5ebf4c2e4a7199bef55389ba0b2a5b4161210231fcb2b7bf1695cf6949c29c77
font_14_cff_off0042aa75.bin pdf-font-stream PDF embedded font (cff) at offset 0x42AA75 484 bytes
SHA-256: 29619ba9b796a603d28e5ee956f7302a8fa32dfabeee3c7d904863b5c24dade8

Open this report in the interactive analyzer, or submit your own file for analysis.