PDF / .VIR static analysis report

Static analysis result for SHA-256 4b74ae42130f53d1…

CLEAN

PDF / .VIR

424.9 KB Created: 2022-10-15 16:39:59 -07:00 Authoring application: Microsoft® Word for Microsoft 365 First seen: 2025-02-11
MD5: 4ec02f4105224a44d7709a470d70424e SHA-1: 4c74195620d6a6de7c77f94c32c1fde615f1dabb SHA-256: 4b74ae42130f53d10e2af9003dc13e37f6ec7d1574e1b43ca09f78b1bbcaf725
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.google.com/books/edition/_/oC08AAAAMAAJ?hl=en&sa=X&ved=2ahUKEwjS9b7joOP6AhXNKUQIHddvDAQQ8fIDegQIGhAK PDF link annotation
    • https://www.google.com/books/edition/_/zuRkmAEACAAJ?hl=en&sa=X&ved=2ahUKEwjaz7nvoeP6AhXMMUQIHUH4BPQQre8FegQIKBBDIn PDF document text
    • http://news.bbc.co.uk/2/hi/africa/3516965.stmIn PDF document text
    • https://www.google.com/books/edition/The_Scramble_for_Africa/lImrAgAAQBAJ?hl=en&gbpv=0In PDF document text
    • https://www.google.com/books/edition/The_Troubled_Heart_of_Africa/wI8FGYHGs-QC?hl=en&gbpv=0In PDF document text
    • http://en.wikipedia.org/wiki/Joseph_MobutuIn PDF document text
    • https://www.google.com/books/edition/Civilizations_Past_and_Present_to_1650/E2InGQAACAAJ?hl=enIn PDF document text
    • https://www.google.com/books/edition/King_Leopold_s_Ghost/vYo-DO4tr-gC?hl=en&gbpv=0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (stream_014_off0002aef4.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_014_off0002aef4.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (stream_014_off0002aef4.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_014_off0002aef4.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/TypographyIn extracted file (stream_014_off0002aef4.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/MicrosoftIn extracted file (font_03_sfnt_off00045a11.bin)

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off0002aef4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2AEF4 87328 bytes
SHA-256: 867a21e971518100f91153da423c140c11aeab59d89eb5edb8d46d19d494f838
stream_020_off000478fa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x478FA 149656 bytes
SHA-256: bce208c185cf8b102a62c23e42c79b8999c2aa0f3c03f59ee9749de6dc705189
font_00_sfnt_off000254f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x254F7 84368 bytes
SHA-256: 9af7d216dc152e1052f27886cd60b0da95d7a07431570f865e65d8d24c0c5510
font_02_sfnt_off00030b8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30B8D 130348 bytes
SHA-256: 456075411beae2edb857d4613392b1cc9fd4478fa468233aed37e05594144f9b
font_03_sfnt_off00045a11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45A11 14392 bytes
SHA-256: d9726ea454c27670afaefaf07c723e61d73ed8b4916c41bac3cdd65a1362ace3
font_05_sfnt_off0005f0b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F0B9 59636 bytes
SHA-256: 8ab076923ce9624c2bbbc9629714120c79c686eb6abe0659c624b65cb4fbba64