PDF / .VIR static analysis report

Static analysis result for SHA-256 50dc9581861b474c…

CLEAN

PDF / .VIR

2.92 MB Created: 2022-02-18 08:37:56 UTC Authoring application: Adobe InDesign CC 13.1 (Macintosh) (via Adobe PDF Library 15.0) First seen: 2025-02-11
MD5: aeffa046620e7bc5b9753f7aa524d5a9 SHA-1: 78ba81720107fdab32bdcabae91cc3f1fa3e8f4f SHA-256: 50dc9581861b474c4334632b886b18a6d00de14573a8421d1b354ba014fc405a
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cipa.jp/exif/1.0/ In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://ns.adobe.com/illustrator/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_043_off0004b3d3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B3D3 111633 bytes
SHA-256: f8267b4956da81b26366b9d3e36b4e236e8b2b37668b0000e570e1697110341d
stream_084_off00157372.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x157372 214344 bytes
SHA-256: 50a388de2feb948a7a2244c4b6c95b58b08fe0d92a7d0b52901eff3c5bde4d54
stream_102_off00204663.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x204663 276804 bytes
SHA-256: 3586f42bf1f9a557934bfea904acad20c4c035319362508a101024ef58e7f564
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.64, consistent with packed or encrypted content.
stream_111_off00265a22.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x265A22 1767600 bytes
SHA-256: a28968df7665bd330b3abee39467c7953a83a3660fdd28c425caf13f65866b7b
icc_00_off000053ce.icc pdf-icc-profile PDF ICC profile at offset 0x53CE 3920 bytes
SHA-256: 29842c1ae057fe5f130ecd7f32b66082cbe65d160d117c617d24d6906f12ddaf
icc_01_off001003ef.icc pdf-icc-profile PDF ICC profile at offset 0x1003EF 560 bytes
SHA-256: e5f6ffb83b6d3491301dd750975684cc5cc2a1951c994a14b08cfdaa0d75a041
font_00_sfnt_off00002c82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C82 12983 bytes
SHA-256: 541c7fc49fbf6f6d8013baa8d1d542403382d1e7d3e7492243ae6ca6a3115983
font_01_cff_off00004831.bin pdf-font-stream PDF embedded font (cff) at offset 0x4831 3635 bytes
SHA-256: ab8fff3d1ace7c59b11388a44ae7ca34413b5de34f89312629e444f9d62d3ab6
font_02_cff_off0000607c.bin pdf-font-stream PDF embedded font (cff) at offset 0x607C 2632 bytes
SHA-256: d4f6e58120d2a2b4368191395d560019327a884cb393ac10df29f4568b1698cb
font_03_sfnt_off0000bbea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBBEA 8774 bytes
SHA-256: 7ff2547affd59e35547150e8fb9dc25827fa0f7d758687998778b4d7598c3e71
font_04_sfnt_off002a9584.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A9584 12043 bytes
SHA-256: 490c491d71eb125a4e1f354bef93c1ee2f67b62c64ce421a95cdaf2bd0af7314
font_05_sfnt_off002ad853.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AD853 15956 bytes
SHA-256: a03821561422d973468f915a7f5906c5152de84300756e063f63d54018a56723
font_06_sfnt_off002d3175.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D3175 9089 bytes
SHA-256: f6c47761f8175fefc24667b6700d1cf2bc91ff841b6fcf33d4954090a16a33a7
font_07_sfnt_off002d460a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D460A 10852 bytes
SHA-256: c1327a8be14e61d88788813aec2e483e7d96204e5d50f09c82f77ddc4aecee92
font_08_sfnt_off002da6b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DA6B6 12369 bytes
SHA-256: 5da2cf1d83b6cb1fc726748d9d1e3cac4da512b9ed7f3f986b07d2f4616a361f

Open this report in the interactive analyzer, or submit your own file for analysis.