PDF / .VIR static analysis report

Static analysis result for SHA-256 5fa879cf99f02e26…

SUSPICIOUS

PDF / .VIR

77.7 KB Created: 2021-12-11 20:30:11 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2024-07-25
MD5: 0d29c9da3f9fd49fb5c38353083f1253 SHA-1: 52a381356c0150c9c4a1cae334c55978f4f07101 SHA-256: 5fa879cf99f02e26e8b1e7cd96571371c570b394121b50df45cdf989e6452821
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0298

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=strik&isbn=9781717188274&kwd=Calligraphy%20Practice%20Paper%20:%20Calligraphy%20Guide%20Paper,%20Calligraphy%20Training,%20Calligraphy%20Paper%20Pad%20For%20Beginners,%20Hand%20Lettering%20Practice%20Paper PDF link annotation
    • https://static.s123-cdn-static-c.com/uploads/4663525/normal_61b2ced28f69a.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4663469/normal_61b2ce420d161.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4664433/normal_61b285c08f6ca.pdfIn PDF document text
    • https://static.s123-cdn-static-b.com/uploads/4663737/normal_61b31c8e44bb3.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4665961/normal_61b3a349cbf01.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0328cca-a25a-4505-a033-e30f25aba4cc/certified-data-center-design-professional-cdcdp-secrets-to-acing-the-exam-and-successful-finding-a-847.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0328cca-a25a-4505-a033-e30f25aba4cc/certified-data-center-design-professional-cdcdp-secrets-to-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000e64e.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e64e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE64E 21068 bytes
SHA-256: 1b519ff341a83e00f4f4be2e9b12d585b9a06e38d93c38bc1f37c86b2c3a8221
font_01_sfnt_off00011683.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11683 15772 bytes
SHA-256: 9e5ce09a16c76f7e40ffa4b7013ca7de372d2a7a46849744e0d0467b2bb0eee0

Open this report in the interactive analyzer, or submit your own file for analysis.