Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 619c290274b7c71d…

MALICIOUS

PDF / .VIR

80.6 KB Created: 2020-11-24 23:38:20 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2024-07-14
MD5: 5ecdeb764822fdbcfa1a1c4084ac7640 SHA-1: cf52397eb5a7f7a1303258f419d960fbad6fd784 SHA-256: 619c290274b7c71dd7fad44fb1a11a5232fc1a9ec633cd5d6bade2991d9edcd8
89 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0146

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=123&isbn=9781447251279&kwd=Big%20Bad%20Wolf PDF link annotation
    • https://uploads.strikinglycdn.com/files/555e4112-3952-4de2-a107-1340c854072a/english-eccentric-a-celebration-of-imaginative-intriguing-and-truly-stylish-interiors-47.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20507d7a-df3a-4f35-a583-3f2425f424de/splat-the-cat-95.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b12939da-5618-4bdc-8479-c2338a73ead1/testimony-crises-of-witnessing-in-literature-psychoanalysis-and-history-100.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90571294-867d-4c4a-8edb-61cc85178986/jesus-and-the-gospels-an-introduction-and-survey-4.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0499/9888/9130/files/deadly-little-sins-73.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f363aa5e-b5d1-4854-b375-4c4caddcbc4d/easy-crossword-puzzles-36.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/555e4112-3952-4de2-a107-1340c854072a/english-eccentric-a-celebration-of-imaginative-intriguing-and-In PDF document text
    • https://uploads.strikinglycdn.com/files/b12939da-5618-4bdc-8479-c2338a73ead1/testimony-crises-of-witnessing-in-literature-psychoanalysis-In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000ee0b.bin)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE0B 21816 bytes
SHA-256: c9cfa9d6cbb6ad3e8983063fb8b90afab91f999452cc240e305d2769f8da68ed
font_01_sfnt_off000120d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120D8 15888 bytes
SHA-256: 79876d651ed107d747739278882f588a3ada888c90fcae3a4275bab37b07d9e3

Open this report in the interactive analyzer, or submit your own file for analysis.