PDF / .VIR static analysis report

Static analysis result for SHA-256 49e9897d9643fec1…

CLEAN

PDF / .VIR

490.5 KB Created: 2017-10-06 22:22:54 +03:00 Authoring application: Microsoft® Word 2013 First seen: 2024-04-16
MD5: 755b57e15833363695a057bcba774916 SHA-1: 9d83befdf5392a6db99e2e5d8a55ccf8286cd49b SHA-256: 49e9897d9643fec12b082c3aeb60f12c9eae8644c184e7a42f904a450379e7aa
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.pedlib.ru/Books/3/0389/3_0389-6.shtml#book_page_top PDF link annotation
    • http://zakinppo.org.ua/2010-01-18-13-44-15/233-2010-08-25-07-10-49In PDF document text
    • http://www.eidos.ru/journal/2005/0910-In PDF document text
    • http://www.itiprao.ru/index.php?option=com_content&view=article&rid=154:confrolcompetIn PDF document text
    • http://zakinppo.org.ua/2010-01-In PDF document text
    • http://vvv.eidos.ru/journal/2005/0910-12.htm/[inIn PDF document text
    • http://vvv.itiprao.ru/indekh.php?option=tsom_tsontent&viev=artitsle&rid=154:tsonfroltsompeIn PDF document text
    • http://ocsp.verisign.com0In extracted file (font_05_sfnt_off0007497b.bin)
    • http://osvita.ua/school/theory/1963In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_015_off0001bdd0.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_015_off0001bdd0.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn extracted file (stream_015_off0001bdd0.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In extracted file (stream_015_off0001bdd0.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_015_off0001bdd0.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_015_off0001bdd0.bin)
    • http://www.microsoft.com/typography/0In extracted file (stream_015_off0001bdd0.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (stream_018_off00043eca.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (stream_018_off00043eca.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_05_sfnt_off0007497b.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_05_sfnt_off0007497b.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_05_sfnt_off0007497b.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_05_sfnt_off0007497b.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_05_sfnt_off0007497b.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_05_sfnt_off0007497b.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_05_sfnt_off0007497b.bin)
🗂 Part of campaign: shared payload 7e4af2d1a4 5 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_015_off0001bdd0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BDD0 190792 bytes
SHA-256: 436237427fad3a1d9474826ce49f5b27e453398ce00eb743df7f5a5dde00c894
stream_017_off0002de40.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2DE40 242816 bytes
SHA-256: b469271aa37263caef3c1317c2578632521a9157ab39d82e7e7e8017a2373a8d
stream_018_off00043eca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43ECA 170420 bytes
SHA-256: 7e4af2d1a4638e37259589c7fe3236dc59c6c0dd5fa327a291f1b3d7d415281f
stream_020_off000572ed.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x572ED 218288 bytes
SHA-256: 132a13efc39420f125aa97ed1eb957caea764e52547e60147f9ea69f0110d2d2
stream_022_off00069356.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x69356 152800 bytes
SHA-256: 973f09491bec989b1e085f08fb9820f1956dc8f3a43f941dc510be5e702eb9f1
font_05_sfnt_off0007497b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7497B 25072 bytes
SHA-256: 13f9caa70cae2ca329ecedf6f608c177f27c921be91031a573ca0a7505fee955

Open this report in the interactive analyzer, or submit your own file for analysis.