PDF / .VIR static analysis report

Static analysis result for SHA-256 478cff6e0b0df895…

SUSPICIOUS

PDF / .VIR

28.2 KB Created: 2021-05-29 18:37:28 UTC Authoring application: Softplicity First seen: 2024-12-23
MD5: b47f606288dc2a3a4c7a718958808865 SHA-1: 84df7e197528ec71cca470f76bb9d8fd14c1225b SHA-256: 478cff6e0b0df895896381f9002fa0e5c12c78e6c1e0f952967fcca8b66c16ab
42 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3249

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5251057/normal_60afedfa9f44a.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5251006/normal_60aff10bd8a08.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b269e708055.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251177/normal_60aff432b3352.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251140/normal_60aff3eb51f62.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251057/normal_60aff28944407.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251104/normal_60aff299e15c7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251102/normal_60afef157de7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26b0f7ce6a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26d6e1fe00.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26d8dc00af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26dbe0cfcc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26d7e3137f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26cf95a58f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26983c56e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26dae0a547.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5255987/normal_60b26d9d4a21d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5251204/normal_60aff69c58134.pdfIn PDF document text
    • http://led.lods.icu/dls.php?q=John+Deere+8700+Manual+MuscleIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: f-static.net 6 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.