PDF / .VIR static analysis report

Static analysis result for SHA-256 736d0ebf04867191…

CLEAN

PDF / .VIR

221.0 KB Created: 2014-12-10 09:44:58 +01:00 Authoring application: Microsoft® Word 2010 First seen: 2024-10-09
MD5: 16b8ba23b26ce2a2ca2037424738c7ab SHA-1: 7d251643a53267eee5836dad73f0e9467bd084e8 SHA-256: 736d0ebf04867191fdb3c54cf60a7a5fc5f1596dec9d4369e6353d1a44517a54
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.impots.gouv.fr/portal/dgi/public/documentation.impot?pageId=docu_international&espId=-1&sfid=440 In PDF document text
    • http://lawandlogic.org/coursebasic/session-5-1-1/In PDF document text
    • http://www.impots.gouv.fr/portal/dgi/public/documentation.impot?pageId=docu_international&espId=-In PDF document text
    • http://ocsp.verisign.com0In extracted file (font_02_sfnt_off0003277d.bin)
    • http://ec.europa.eu/taxation_customs/taxation/company_tax/double_taxation_conventions/index_en.htmPDF link annotation
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000f871.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_00_sfnt_off0000f871.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_00_sfnt_off0000f871.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn extracted file (font_00_sfnt_off0000f871.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In extracted file (font_00_sfnt_off0000f871.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_00_sfnt_off0000f871.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_00_sfnt_off0000f871.bin)
    • http://www.microsoft.com/typography/0In extracted file (font_00_sfnt_off0000f871.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_01_sfnt_off0002a644.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_02_sfnt_off0003277d.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_02_sfnt_off0003277d.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_02_sfnt_off0003277d.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_02_sfnt_off0003277d.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_02_sfnt_off0003277d.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_02_sfnt_off0003277d.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f871.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF871 310952 bytes
SHA-256: c8c738125ff2e456dd97aeca7f86094b5ef1eda9ff2d63a3ba998c90d83a3dd0
font_01_sfnt_off0002a644.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A644 69228 bytes
SHA-256: 50e9fbed9c533b5f5010968583d8912938eab9a7195dcdb44e1712a79c11e3bb
font_02_sfnt_off0003277d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3277D 24332 bytes
SHA-256: ca6c494bb5ef9be7361cfad38425c9e5ec46bc51a29f0a9ed3e0b4866540a7f4