PDF / .VIR static analysis report

Static analysis result for SHA-256 6d6b2c587a1e3b9e…

SUSPICIOUS

PDF / .VIR

28.4 KB Created: 2021-05-30 19:04:37 UTC Authoring application: Softplicity First seen: 2025-01-08
MD5: ff6150b2bcf2523118db613d87e79b73 SHA-1: 3e31f0d86fbdd3775be3d58df4b758c386a5d029 SHA-256: 6d6b2c587a1e3b9e04fecd3cb771ef3feb9c3b9c058148b05520fd9008c6ef34
34 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3249

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5256514/normal_60b2c50d4a56c.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5256565/normal_60b2c0339d5a7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c4ec30f78.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256544/normal_60b2ba1091aa0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256490/normal_60b2bb34ca189.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256565/normal_60b2bfd27087d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256548/normal_60b2bf82e7093.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256561/normal_60b2c3af72c6a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c51ce31f3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c56b6d849.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c57ab52e6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c55b71451.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c58a2c871.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c1586c7c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3bfe1399c7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c59a0f1bd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258186/normal_60b3c54c37864.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256483/normal_60b2bc5915772.pdfIn PDF document text
    • http://jof.lods.icu/dls.php?q=Televic+Tcs+5500+ManualIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.