PDF / .VIR static analysis report

Static analysis result for SHA-256 68fb9630ac447cb1…

CLEAN

PDF / .VIR

109.4 KB Created: 2024-12-19 23:58:19 +00:00 Authoring application: mPDF 7.1.6 First seen: 2024-12-23
MD5: 5a599e6072bc461ccaf6a9f18e04017c SHA-1: 724c5bf51a4a0dfc4f4d251775c3425a16d628b9 SHA-256: 68fb9630ac447cb16ba24c198cd88122997017c7e1a7f71f9bffea92934fd084
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lowmp3.com/jazz/141236-the-john-warren-orchestra-scarlett-oharai-will-follow-him.html PDF link annotation
    • https://lowmp3.com/file.php?fn=VGhlIEpvaG4gV2FycmVuIE9yY2hlc3RyYSAtIFNjYXJsZXR0IE8nSGFyYSAvIEkgV2lsbCBGb2xsb3cgSGltIChNUDMp&a=cmFy&s=MTcwOSBtYg==&i=L2ltYWdlcy8xMDUvdGhlLWpvaG4td2FycmVuLW9yY2hlc3RyYS1zY2FybGV0dC1vaGFyYS0taS13aWxsLWZvbGxvdy1oaW0uanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=VGhlIEpvaG4gV2FycmVuIE9yY2hlc3RyYSAtIFNjYXJsZXR0IE8nSGFyYSAvIEkgV2lsbCBGb2xsb3cgSGltIChGTEFDKQ%3D%3D&a=cmFy&s=MTg2MiBtYg==&i=L2ltYWdlcy8xMDUvdGhlLWpvaG4td2FycmVuLW9yY2hlc3RyYS1zY2FybGV0dC1vaGFyYS0taS13aWxsLWZvbGxvdy1oaW0uanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=VGhlIEpvaG4gV2FycmVuIE9yY2hlc3RyYSAtIFNjYXJsZXR0IE8nSGFyYSAvIEkgV2lsbCBGb2xsb3cgSGltIChXTUEp&a=cmFy&s=MTQ1OCBtYg==&i=L2ltYWdlcy8xMDUvdGhlLWpvaG4td2FycmVuLW9yY2hlc3RyYS1zY2FybGV0dC1vaGFyYS0taS13aWxsLWZvbGxvdy1oaW0uanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=VGhlIEpvaG4gV2FycmVuIE9yY2hlc3RyYSAtIFNjYXJsZXR0IE8nSGFyYSAvIEkgV2lsbCBGb2xsb3cgSGlt&a=bXAz&s=MTcwOSBtYg==&i=L2ltYWdlcy8xMDUvdGhlLWpvaG4td2FycmVuLW9yY2hlc3RyYS1zY2FybGV0dC1vaGFyYS0taS13aWxsLWZvbGxvdy1oaW0uanBn&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/pop/341722-al-allen-scarlett-oharagive-in-to-love.pdfIn PDF document text
    • https://lowmp3.com/electronic/322087-adrian-scarlett-monkeys-energie-ep.pdfIn PDF document text
    • https://lowmp3.com/electronic/269159-scarletttake-my-heart-and-runevery-ones-a-killer.pdfIn PDF document text
    • https://lowmp3.com/electronic/259972-robsounds-scarlett-ep.pdfIn PDF document text
    • https://lowmp3.com/pop/258954-scarlett-coprimi.pdfIn PDF document text
    • https://lowmp3.com/electronic/177860-audio-soul-project-hello-scarlett.pdfIn PDF document text
    • https://lowmp3.com/hip-hop/153180-will-scarlettfeaturing-kegzi-coffee-mate.pdfIn PDF document text
    • https://lowmp3.com/rock/117481-pete-yornscarlett-johansson-break-up.pdfIn PDF document text
    • https://lowmp3.com/rock/106220-francisfollow-me-home.pdfIn PDF document text
    • https://lowmp3.com/electronic/6103-stratus-you-must-followyou-must-follow-dieselboykaos-remix.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_003_off0000261f.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_003_off0000261f.bin)
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000261f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x261F 19824 bytes
SHA-256: b5a056ebcfa63b81c85d4fd1ac3bc6fe76845c50664add9735242967184c2e9d
font_01_sfnt_off000059ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59EE 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00008e06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8E06 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1

Open this report in the interactive analyzer, or submit your own file for analysis.