PDF / .VIR static analysis report

Static analysis result for SHA-256 5818bac0db44f368…

CLEAN

PDF / .VIR

712.3 KB Created: 2023-07-01 16:22:01 Authoring application: OpenOffice Draw First seen: 2024-09-20
MD5: b59830af947d7a07d3d3aa84f178ac67 SHA-1: aeec869fe56844422171eaeab010e26b61ef9e48 SHA-256: 5818bac0db44f368732367cb2e52d59fe35f927e86151dc078aa04b91ab40a41
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0105

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gamivew.biaremodelor.org/102468.pdf In PDF document text
    • https://adservice.google.com.pg/ddm/clk/466651624;272226156;i;;%3F//2009-pontiac-g5-owner-s-manual-pdf.fachinternist-syke.de/fetud.pdfIn PDF document text
    • https://classic-wow-orc-rogue-leveling-guide.mikefrazier4homes.com/71832.pdfIn PDF document text
    • https://flights-from-boston-to-barbados.was-kostet-ein-konflikt.de/ledobemote.pdfIn PDF document text
    • https://drury-management-and-cost-accounting-7th.bauernladen-bauer.de/jotosalolot.pdfIn PDF document text
    • https://adservice.google.com.mt/ddm/clk/408405163;208572896;n;;%3F//img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/7287692824.pdfIn PDF document text
    • https://joyce-meyer-ministries-daily-devo.meandaur.com/xowitak.pdfIn PDF document text
    • https://lincoln-riley-offense-playbook-pdf.lubu2go.de/nikol.pdfIn PDF document text
    • https://adservice.google.tg/ddm/clk/424929466;226923624;r;;%3F//img1.wsimg.com/blobby/go/8ce90cf7-f544-4910-b102-273c5343e842/downloads/lemotipipovowopumemigoso.pdfPDF link annotation
    • https://img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/my_singing_monsters_composer_apk_obb.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edeb9fee622c5eaab1a35b/6563e5b52f4bdd2459d93d72_39679017227.pdfIn PDF document text
    • https://adservice.google.gy/ddm/clk/310682673;138356009;g;;%3F//uploads-ssl.webflow.com/64f850893a05ffa0052b7994/6563e5c9c9018bf97878e88b_1537784916.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/f81616d7-0fca-43f2-96cf-9f4c02a38e00/downloads/delonghi_caffe_corso_manual.pdfIn PDF document text
    • https://adservice.google.es/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/8ce90cf7-f544-4910-b102-273c5343e842/downloads/tulevodiroluwakilujemoli.pdfIn PDF document text
    • https://adservice.google.nu/ddm/clk/426382440;228185261;d;;%3F//mn-state-fair-app.tripleb-ent.com/zagigesakeje.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f1ab3aed886d13a67ee302/6563e617b08c1110d0e48c6b_36770367795.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64ede3da331752eaad180ad5/6563e5a72f4bdd2459d9389a_dutawuxonulofulotowa.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/ba9b549d-a804-4d13-a818-3c55b3524acd/downloads/56492821579.pdfIn PDF document text
    • https://adservice.google.com.hk/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/ab99d6d0-ac83-4377-8785-ef8244f643a1/downloads/36597147026.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/31391198332.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/64365467988.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/managing_corporate_lifecycles_ichak_adizes.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/ba9b549d-a804-4d13-a818-3c55b3524acd/downloads/temimime.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edf35c56e09fc697e76c44/6563e64616d0ec6bd3c239c2_guxopaxuko.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f8540fa0f473527cfee9a0/6563e610aff76e6b4c63cbca_27067547982.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edeb9fee622c5eaab1a35b/6563e5e1dcbd1d3b7f1fd926_vagod.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f8540fa0f473527cfee9a0/6563e5f2dcbd1d3b7f1fdf72_zizuse.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edeb9fee622c5eaab1a35b/6563e5cbbd5ebaf676162645_sutumuwivun.pdfIn PDF document text
    • https://adservice.google.cm/ddm/clk/478229754;284365575;c;;%3F//writing-today-2nd-edition-pdf-free.kamanana.com/tupalez.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/f81616d7-0fca-43f2-96cf-9f4c02a38e00/downloads/42962086890.pdfIn PDF document text
    • https://adservice.google.ht/ddm/clk/425484003;227454619;f;;%3F//uploads-ssl.webflow.com/64ee1c9ec0f2c702ff5c628e/6563e5aa9cd7f6b881851557_mulaxosa.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/ab99d6d0-ac83-4377-8785-ef8244f643a1/downloads/embodied_cognition_theory.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edeae32cfc8f8136fcbd05/6563e5c9dcbd1d3b7f1fcd02_15575961572.pdfIn PDF document text
    • https://adservice.google.kz/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/87316370847.pdfIn PDF document text
    • https://adservice.google.com.br/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/4ab9731d-5baf-4d15-9e11-93c7943f29a9/downloads/71985394346.pdfIn PDF document text
    • https://adservice.google.tl/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/1359a19c-d7f3-4e68-b618-51f3a1c7e8fd/downloads/gorigobepifos.pdfIn PDF document text
    • https://adservice.google.at/ddm/clk/448794861;252804937;a;;%3F//img1.wsimg.com/blobby/go/f81616d7-0fca-43f2-96cf-9f4c02a38e00/downloads/13203100966.pdfIn PDF document text
    • https://adservice.google.ht/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/ba9b549d-a804-4d13-a818-3c55b3524acd/downloads/43408311943.pdfIn PDF document text
    • https://adservice.google.co.nz/ddm/clk/426382440;228185261;d;;%3F//xezoziwupu.str-tischtennis.de/gatij.pdfIn PDF document text
    • https://adservice.google.sc/ddm/clk/448794861;252804937;a;;%3F//uploads-ssl.webflow.com/64f84d4caa4a07bb1a11231c/6563e618e531be60fde74e8a_12089241788.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000a7758.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000a7758.bin)

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000a7758.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA7758 17880 bytes
SHA-256: d3d1597df79fff8225aae66fa2b387759ec8a6d0495bd5813c0a1fc44f0e79bf
font_01_sfnt_off000a930c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA930C 27216 bytes
SHA-256: 1140cfe3f00e857c69cca4f0be2360c028d899231bfa3865ccfe65631f04fc7c
font_02_sfnt_off000adc1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xADC1B 2516 bytes
SHA-256: 0b7e5c5f69c9a1932aab93a89c11996d38fd3641ff93fc9921ccdf452cfabf6a
font_03_sfnt_off000ae7f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE7F2 10992 bytes
SHA-256: d159a1fec7a5ce1e1e01f93e0dcef5263d47ca071d5b50f028cc39d953f055c2