PDF / .VIR static analysis report

Static analysis result for SHA-256 565a3227a72172f1…

CLEAN

PDF / .VIR

803.1 KB Created: 2023-06-11 07:53:43 -04:00 Authoring application: Microsoft® PowerPoint® for Microsoft 365 First seen: 2024-07-29
MD5: ddf13f735a114291b35bbef96c333185 SHA-1: 15fbbbb13c2dc0ca7daec1b35beec283f9c770e6 SHA-256: 565a3227a72172f1f42cfd37ad41eb6d36d7adeb75f28544c52b6013dd2f6a29
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.fabianwaldinger.com/_files/ugd/0d0a02_6fef951d28064c8db2cf06d6dfa0cff6.pdf In PDF document text
    • https://www.fabianwaldinger.com/_files/ugd/0d0a02_6fef9In PDF document text
    • https://wwww.microsoft.com0In extracted file (stream_074_off0005fdf7.bin)
    • https://www.publichealth.columbia.edu/research/population-health-methods/difference-difference-estimationPDF link annotation
    • https://databank.worldbank.org/source/world-development-indicatorsIn PDF document text
    • https://docs.iza.org/dp13524.pdfIn PDF document text
    • http://repec.sowi.unibe.ch/stata/coefplot/getting-started.htmlIn PDF document text
    • http://www.nber.org/WNE/lect_10_diffindiffs.pdfIn PDF document text
    • http://www.princeton.edu/~otorres/In PDF document text
    • http://www.princeton.edu/~otorres/WDI.dtaIn PDF document text
    • http://www.princeton.edu/~otorres/Treated.dtaIn PDF document text
    • http://www.princeton.edu/~otorres/eventX.dtaIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (stream_074_off0005fdf7.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_074_off0005fdf7.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_074_off0005fdf7.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pkiops/Docs/Repository.htm0In extracted file (stream_074_off0005fdf7.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In extracted file (stream_074_off0005fdf7.bin)
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn extracted file (stream_076_off00069636.bin)
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In extracted file (stream_076_off00069636.bin)
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comMicrosoftIn extracted file (font_04_sfnt_off00089db1.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_04_sfnt_off00089db1.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_07_sfnt_off0009bc73.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_07_sfnt_off0009bc73.bin)

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_037_off00040d03.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x40D03 10440 bytes
SHA-256: a7a0441b2225bab86e674e4265a05362d9b7a43ebecb5938f83485cd8841458e
stream_059_off0004d0fc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D0FC 10440 bytes
SHA-256: bccf71cfb6c52a2b6ded420dd14318dcba34e5d1ae9e5b300e905c9f70020826
stream_074_off0005fdf7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5FDF7 112132 bytes
SHA-256: b631af733a347c3de620bb6b8008c69f9570d7ece4736353fdc8f3950e1a3aa8
stream_076_off00069636.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x69636 160688 bytes
SHA-256: 1560329c42cd417db4d382c48ca39fe189b098b0b68d17e600796d7ed690f5be
font_02_sfnt_off00079753.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79753 73668 bytes
SHA-256: e92a7f9be03292bcd3a261e5695c609b6397d416c1faef88acaf666efb41406e
font_03_sfnt_off0007f7af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F7AF 112856 bytes
SHA-256: eb3fcabd01f6a7324c5134c863a36c4ac731fcd0973c816d932661aa27f40bd4
font_04_sfnt_off00089db1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x89DB1 93480 bytes
SHA-256: a77a1f2d257e1058a18352820cc93a8cfe5a7a33498520e36c5ec9798ed88518
font_05_sfnt_off0009116d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9116D 59128 bytes
SHA-256: f755bef8560eae3cdee657d6572580e080d104799c3eef06c7152d83d7ff398b
font_06_sfnt_off0009580c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9580C 90708 bytes
SHA-256: 4c966518649624d670d62bcc95e723e22cf114c6d381e6592bf4816742e7e684
font_07_sfnt_off0009bc73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BC73 74764 bytes
SHA-256: f081314062198e617eab491c04c83b6ad604e42f00d63b5928088d7b6ef1d39f
font_08_sfnt_off000a5ad9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA5AD9 52956 bytes
SHA-256: b4e58b59a06f24103255bd9bc1773d64d0ee8c3e73c99ca8446cc750b49e5584
font_09_sfnt_off000ac6b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC6B3 69688 bytes
SHA-256: 7153b200c6f50874bcb33d1846f9b4fefd43e3a825b67c20d4e1a5405b797df0
font_10_sfnt_off000b520b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB520B 48876 bytes
SHA-256: 9ea289ab1bcf26b3295095bfd2b00a070cc6e9b6180b9268c59fbee16af1bad0