Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 6e068495c587ff8d…

MALICIOUS

PDF / .VIR

2.05 MB Created: 2017-11-29 20:34:34 Authoring application: Microsoft® Office Word 2007 First seen: 2025-02-07
MD5: 930dc3324ff72823fa08fa2cbe5b5052 SHA-1: be9cac78d2152cd17c39df5f447fc45982a4364b SHA-256: 6e068495c587ff8d0688b870251b73489b77fea2633d8b4508b034fba4ce3d29
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a heuristic firing for 'SE_TRAVEL_SUPPORT_PHONE_SCAM' due to an extreme number of phone numbers, indicating a likely scam. An external URI, http://www.impepac.mx/, was also extracted. The document body is heavily obfuscated and does not provide clear textual content to support the scam's pretext.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.impepac.mx/ PDF link annotation
    • http://www.ijf.cjf.gob.mx/publicaciones/revista/28/Delitos_inform%C3In PDF document text
    • http://www.e-consulta.com/opinion/2014-03-01/delitos-ciberneticos-In PDF document text
    • http://ocsp.verisign.com0In extracted file (font_00_sfnt_off00180dfc.bin)
    • http://informaticsjimenez.blogspot.mx/2012/07/el-internet-como-In PDF document text
    • http://revista.seguridad.unam.mx/numero26/delitos-inform-ticos-en-In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn extracted file (stream_148_off00196aea.bin)
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In extracted file (stream_148_off00196aea.bin)
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn extracted file (stream_148_off00196aea.bin)
    • http://www.microsoft.com/pki/certs/tspca.crt0In extracted file (stream_148_off00196aea.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_148_off00196aea.bin)
    • http://www.microsoft.com/typography/fonts/In extracted file (font_00_sfnt_off00180dfc.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_00_sfnt_off00180dfc.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_00_sfnt_off00180dfc.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_00_sfnt_off00180dfc.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_00_sfnt_off00180dfc.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_04_sfnt_off001a6c3d.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_04_sfnt_off001a6c3d.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/YouIn extracted file (font_05_sfnt_off001a98ec.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_148_off00196aea.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x196AEA 215692 bytes
SHA-256: f80cff1c28ac5efe2994151e7130d0b199ffad88c13622c9e830841d3e97df87
font_00_sfnt_off00180dfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x180DFC 38956 bytes
SHA-256: 0b774f9c0160f88f5a1db604800b0cadb0239b6bbda99e07698015ae64a15828
font_01_sfnt_off001844d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1844D0 90072 bytes
SHA-256: 1c865deaccd87a6f139bc62eb6c781a0bee1c6cdd6aa865af599d9386efc907c
font_02_sfnt_off0018a57c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18A57C 189840 bytes
SHA-256: 12e4440051c7997954e3352e7cd6dea06a1427773eb2806c5475369a1d555738
font_04_sfnt_off001a6c3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A6C3D 23148 bytes
SHA-256: 0b3442a5dcced2030300296a2148b0268e2c3b7f9da43b270d9146a79b0cbfd3
font_05_sfnt_off001a98ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A98EC 28052 bytes
SHA-256: b073422cdcaedd277ac4d181c359c4de77a07df2378371b0b7e07bb4d09a3cc2
font_06_sfnt_off001acc5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1ACC5D 56804 bytes
SHA-256: 15edbd3d172a16892dd83b7e90da0fd4fe04b430044012f42794d2fcdfd59297
font_07_sfnt_off001b316c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B316C 76260 bytes
SHA-256: c483980f6a0ebad4986b585e04bd8453fc84251a9c10277da232d6df809cef0d

Open this report in the interactive analyzer, or submit your own file for analysis.