PDF / .VIR static analysis report

Static analysis result for SHA-256 4bee62573082676b…

CLEAN

PDF / .VIR

466.2 KB Created: 2024-11-21 14:53:30 +09:00 Authoring application: Adobe InDesign 15.1 (Macintosh) (via Adobe PDF Library 15.0) First seen: 2025-02-28
MD5: f14d954c532390434bebe0d61ee6d7d7 SHA-1: cebbcd24b48644f87fb4fed5d136dba1b63c48b4 SHA-256: 4bee62573082676b1996015974147cb1e2856c084840fad52506fa8e3666f996
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off00013430.icc)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off000050e5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50E5 11325 bytes
SHA-256: c870ecf7c3f32e6e4c3f28373327a4e7ad448bb41cfc89320b6a711c591b4619
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
stream_012_off00007c86.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7C86 49384 bytes
SHA-256: 386a147c4b58432454cd496e3b1d6f09b6411d67e4b9dae99e1df4ab084180ba
icc_00_off00013430.icc pdf-icc-profile PDF ICC profile at offset 0x13430 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_02_cff_off00014797.bin pdf-font-stream PDF embedded font (cff) at offset 0x14797 311296 bytes
SHA-256: fc7b24eb4cdabcc32aeb7bb7b97a12ab1ad755468c02d4dc1b076e6fec9b8d48
font_03_sfnt_off0005760f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5760F 218019 bytes
SHA-256: a9bd5e53e46ade6d1aabd3e045e0c3e227daf5aefae03c98bfc3ac5358e723eb
font_04_cff_off0006bebc.bin pdf-font-stream PDF embedded font (cff) at offset 0x6BEBC 590 bytes
SHA-256: e83d43a32b70bec2d34d44aeec17eba5e3282a29dc0e639e1615cc297d32dd6f
font_05_sfnt_off0006c29f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C29F 41140 bytes
SHA-256: 27493bc71b071ce6d4f2432d910f105836c0b5bb9377f9f9f894402ba74a5ee9

Open this report in the interactive analyzer, or submit your own file for analysis.