Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 4716ee01d52cbca7…

MALICIOUS

PDF / .VIR

5.52 MB Created: 2023-01-11 15:46:34 -06:00 Authoring application: Adobe InDesign 18.1 (Windows) (via Adobe PDF Library 17.0) First seen: 2025-12-03
MD5: f17384e656f6557a0eddb311334abe7d SHA-1: 87ceeae2f62abfc34341cbb94fba5bc93f4f625d SHA-256: 4716ee01d52cbca71bc0ed00146aa6a0b89d38dd82ab498757350beff56229f4
184 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1055

Heuristics 7

  • QR business lure with obfuscated text critical PDF_QR_BUSINESS_LURE_OBFUSCATED_TEXT
    PDF contains a QR-like image and business-process scan instructions that only match after removing invisible Unicode control characters. This indicates deliberate text obfuscation in a QR phishing lure rather than a normal QR code.
  • QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
    PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
  • QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LURE
    Document asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rydin.com PDF link annotation
    • https://www.rydin.com/shop/pages/public/doc/Materials_SecurityFeatures_Page2022.pdfIn PDF document text
    • http://ns.useplus.org/ldf/xmp/1.0/In PDF document text
    • https://www.rydin.com/shop/pages/public/doc/ES_MS_brochure_updated2022.pdfIn PDF document text
    • https://www.rydin.com/shop/pages/public/doc/Rydin_High_School_Brochure_update2022.pdfIn PDF document text
    • https://hubs.li/Q019qC2p0In PDF document text
    • https://hubs.li/Q019pGCs0In PDF document text
    • https://hubs.li/Q019p8vb0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://www.shutterstock.com/license?utm_source=iptc&utm_medium=googleimages&utm_campaign=webstatementIn PDF document text
    • https://www.shutterstock.com/image-photo/139886491?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/782845411?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/1195675963?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • https://www.shutterstock.com/image-photo/1937359558?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/348903029?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/1008220951?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/1147700213?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://www.shutterstock.com/image-photo/1371617297?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Font#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • https://hubs.ly/Q019pb1_0In PDF document text
    • https://hubs.li/Q019pc1M0In PDF document text
    • https://hubs.li/Q019pjVS0In PDF document text
    • https://hubs.li/Q019qGL00In PDF document text
    • https://hubs.li/Q019qwYB0In PDF document text
    • https://hubs.li/Q019qVn40In PDF document text
    • https://hubs.li/Q019qqQ10In PDF document text
    • https://hubs.li/Q019q5p70In PDF document text
    • https://www.shutterstock.com/image-photo/1049762471?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://hubs.li/Q019q_8h0In PDF document text
    • https://hubs.li/Q019pnJT0In PDF document text
    • https://hubs.li/Q019pscn0In PDF document text
    • https://hubs.li/Q019qYk30In PDF document text
    • https://www.shutterstock.com/image-photo/574741411?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    • https://hubs.li/Q019pBmG0In PDF document text
    • https://hubs.li/Q019qSzd0In PDF document text
    • https://www.shutterstock.com/image-photo/1695668008?utm_source=iptc&utm_medium=googleimages&utm_campaign=imageIn PDF document text
    +28 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_069_off000d3cc9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD3CC9 71247 bytes
SHA-256: 40810fb3ce3756671e28e355171abc7b6dba722066d73dc94ce71bea8f927a3c
stream_089_off0011af02.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11AF02 101727 bytes
SHA-256: bd1cc50130f48abd6088d0ea1a1cec8e2db486f943c9439f1e9d60f9e54ea4ab
stream_118_off0027dd40.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x27DD40 34336 bytes
SHA-256: 9da4c5666119d47251445aed38aba6b60436de799a0c16de79c7e45403e2ca6c
stream_123_off00288979.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x288979 34348 bytes
SHA-256: 41ff7f86b98c696f487249c4c428d7ae3f23c914062049678db9e1f983d2cc79
icc_00_off000063ec.icc pdf-icc-profile PDF ICC profile at offset 0x63EC 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0000715a.bin pdf-font-stream PDF embedded font (cff) at offset 0x715A 5480 bytes
SHA-256: 713ba44affa082f63f57134a845818416f8745cd5b69945cbf6486189ead0cc7
font_01_cff_off000083df.bin pdf-font-stream PDF embedded font (cff) at offset 0x83DF 4186 bytes
SHA-256: dccfb5dfac0a9ae0573e0ffe8edfb1b6b666c307b7387dd6ebc8b7609621f260
font_02_cff_off00009284.bin pdf-font-stream PDF embedded font (cff) at offset 0x9284 4958 bytes
SHA-256: e11634226865d1a43fca9838da261cdb57c05b7ae7ae2979b23834f6f6aeafac
font_03_cff_off0000a2a8.bin pdf-font-stream PDF embedded font (cff) at offset 0xA2A8 5770 bytes
SHA-256: ecded553db32a0ee3d6b660d1cd7ff9b1acace50bb7a20cfd61514dec30fe19f
font_04_sfnt_off0000b62c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB62C 7600 bytes
SHA-256: 0a06e7a2951558431af3d112bd08a112bec12ada5e6698d344cdb9cf6789c167
font_05_sfnt_off0000ce19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE19 6557 bytes
SHA-256: 3612df10403b9a172b03c989fe408af7736c3e6dd3bfd935eb8f787030ad2ede
font_06_sfnt_off002789ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2789EA 14084 bytes
SHA-256: 6439e9908111ea17c7ad1a8f1e0cc0f49c37811e47f8831d6b150ec2ee1dc579
font_07_sfnt_off0027a935.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27A935 11298 bytes
SHA-256: 679617da8eb5aa6426b98918801a6e30e666c05fae25a54b36667f605927ef89
font_08_sfnt_off0027c1b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27C1B0 12430 bytes
SHA-256: 3b2fd20063359e208165f7628e1099924f7e7712dcaf911c909918ee2053b69e
font_10_sfnt_off00282aec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x282AEC 11896 bytes
SHA-256: e761180e386fbf850b8ca4ffd80c3d5a9e5359eb3c07479c218aa5e150293590
font_11_sfnt_off00284545.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x284545 13006 bytes
SHA-256: 6f32abe7d92282585d8279ee119be79a6b783136e8fceee64de9b18e1a2440a7
font_12_sfnt_off002861bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2861BD 12516 bytes
SHA-256: f325f2ca138335252a7d08d2834544c3eb9384518bb2b04825d78ba66a8e87d7
font_13_sfnt_off00287d2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x287D2B 3755 bytes
SHA-256: bdfa11571f5479fc2c7b72cd8b5bae98f76c5b095525324d490a53add9ab8d31
font_15_sfnt_off0044d82b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44D82B 55442 bytes
SHA-256: b95d714c723d0a11f5e7cb2ae0db8361bc886cb2c85dd8aef02054ecc0d68e0a
font_16_cff_off0056b662.bin pdf-font-stream PDF embedded font (cff) at offset 0x56B662 4506 bytes
SHA-256: e74d34f19afd5031b45a310212b340fc9d0f5a61b40154f3a56ceba0297d2cc2
font_17_cff_off0056ebc8.bin pdf-font-stream PDF embedded font (cff) at offset 0x56EBC8 2790 bytes
SHA-256: c8f09a2958296fc77faca71b6cc5a8e56371b807823f65f4cb413faeadfb4174
font_18_cff_off00573107.bin pdf-font-stream PDF embedded font (cff) at offset 0x573107 3077 bytes
SHA-256: 24335a6bdf31f0fa3b0728f212b8ac980053273a50eee8ff0b634bc2573ef9d5

Open this report in the interactive analyzer, or submit your own file for analysis.