PDF / .VIR static analysis report

Static analysis result for SHA-256 4a84b365d23dd833…

CLEAN

PDF / .VIR

775.8 KB Created: 2018-11-22 22:25:25 +01:00 Authoring application: Adobe InDesign CC 14.0 (Macintosh) (via Adobe PDF Library 15.0) First seen: 2025-02-07
MD5: fb2770b9f82d7d562cff2d72d3933e84 SHA-1: 48dbd318971da48e1952a9b4b9745625356f113c SHA-256: 4a84b365d23dd8337667c8757b382560e711a6f38cb2298f14c95d8795a98376
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.linotype.comhttp://www.linotype.com/fontdesignersNOTIFICATION In extracted file (stream_009_off000100c9.bin)
    • http://www.linotype.com/licenseNumberIn extracted file (stream_009_off000100c9.bin)
    • http://www.linotype.comhttp://www.linotype.com/fontdesignersAllIn extracted file (font_00_sfnt_off00001df1.bin)
    • http://www.LinotypeLibrary.com/http://www.LinotypeLibrary.com/AllIn extracted file (font_02_sfnt_off00009f1e.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off000089ff.icc)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off000100c9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x100C9 46551 bytes
SHA-256: a7ebb4b970340f22bab99e43355db5bd0ccba735cf8eb4f36850a4509d13eb74
icc_00_off000089ff.icc pdf-icc-profile PDF ICC profile at offset 0x89FF 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00001df1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DF1 64114 bytes
SHA-256: a52d6c1c7e5f0570f113f2f674b2844641935144cee5625f351003e72c533e9e
font_01_cff_off000094dd.bin pdf-font-stream PDF embedded font (cff) at offset 0x94DD 2028 bytes
SHA-256: f78120f9813f608a0d6d8bf5788a88d63e356113cb8d94aa38894381947ba121
font_02_sfnt_off00009f1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F1E 55098 bytes
SHA-256: f13fe01b49d22cad3927814495d294d87122cbc4ad78b4b5052172b8b565c778
font_04_sfnt_off00088a62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x88A62 37651 bytes
SHA-256: ff35618e50739510a96958e6945b8fe0672eb568937fa0fa8b5a784030ab990c
font_05_cff_off0008cb75.bin pdf-font-stream PDF embedded font (cff) at offset 0x8CB75 5362 bytes
SHA-256: 71cd3fed8fe90d45b64d9e5f595945adb1f381c51d177634d2abcdb8f0835355
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.45, consistent with packed or encrypted content.
font_06_sfnt_off0008e25d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E25D 26082 bytes
SHA-256: 0300b80865c10f2bd2f6b80fc4df2a95464fb7bb78f48c730834a447be9b974b

Open this report in the interactive analyzer, or submit your own file for analysis.