PDF / .VIR static analysis report

Static analysis result for SHA-256 78afb696c429424e…

CLEAN

PDF / .VIR

1.55 MB Created: 2018-11-26 13:17:19 +02:00 Authoring application: Microsoft® Word 2010 First seen: 2024-04-16
MD5: 3a8ac6bc2298ef953673c675c733e4bc SHA-1: e6e76ffcfb0cbe7b2a6f9c4c4f04cf764b218147 SHA-256: 78afb696c429424e2e61e0ab79d66726ff03fe6135d9ee61a65f74d51c7d70fc
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 In extracted file (font_07_sfnt_off001281f2.bin)
    • https://uk.wikipedia.org/wiki/%D0%9B%D0%B8%D0%BC%D0%B0%D0%BDPDF link annotation
    • http://uk.wikipedia.org/wiki/%D0%9E%D0%B7%D0%B5%D1%80%D0%BEIn PDF document text
    • http://uk.wikipedia.org/wiki/%D0%A7%D0%BE%D1%80%D0%BD%D0%B5_%D0%BC%D0%BE%D1%80%D0%B5In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%91%D0%B0%D1%81%D0%B5%D0%B9%D0%BDIn PDF document text
    • http://uk.wikipedia.org/wiki/%D0%94%D1%83%D0%BD%D0%B0%D0%B9In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9A%D1%83%D0%B3%D1%83%D1%80%D0%BB%D1%83%D0%B9In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9A%D1%80%D0%B8%D0%BC%D1%81%D1%8C%D0%BA%D0%B8%D0%B9_%D0%BF%D1%96%D0%B2%D0%BE%D1%81%D1%82%D1%80%D1%96%D0%B2In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9A%D0%B0%D1%82%D0%BB%D0%B0%D0%B1%D1%83%D1%85In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%94%D0%BE%D0%BD%D1%83%D0%B7%D0%BB%D0%B0%D0%B2In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%A1%D0%B2%D1%96%D1%82%D1%8F%D0%B7%D1%8CIn PDF document text
    • http://uk.wikipedia.org/wiki/%D0%91%D1%83%D0%B3In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9F%D1%83%D0%BB%D0%B5%D0%BC%D0%B5%D1%86%D1%8C%D0%BA%D0%B5In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%A2%D1%83%D1%80%D1%81%D1%8C%D0%BA%D0%B5_%D0%BE%D0%B7%D0%B5%D1%80%D0%BEIn PDF document text
    • http://uk.wikipedia.org/wiki/%D0%A1%D0%B0%D1%81%D0%B8%D0%BA_In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%AF%D0%BB%D0%BF%D1%83%D0%B3_In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9A%D0%B0%D0%B3%D1%83%D0%BB_In PDF document text
    • http://uk.wikipedia.org/wiki/%D0%9A%D0%B8%D1%82%D0%B0%D0%B9_In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn extracted file (stream_102_off000d1563.bin)
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In extracted file (stream_102_off000d1563.bin)
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn extracted file (stream_102_off000d1563.bin)
    • http://www.microsoft.com/pki/certs/tspca.crt0In extracted file (stream_102_off000d1563.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_102_off000d1563.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (font_04_sfnt_off001005ba.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_04_sfnt_off001005ba.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_07_sfnt_off001281f2.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_07_sfnt_off001281f2.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_07_sfnt_off001281f2.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_07_sfnt_off001281f2.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_07_sfnt_off001281f2.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_07_sfnt_off001281f2.bin)
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comYouIn extracted file (font_09_sfnt_off0013e11c.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/YouIn extracted file (font_10_sfnt_off001591e0.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_102_off000d1563.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD1563 204984 bytes
SHA-256: d0d53fcb481293b22b1c0ab471fae0795aef0781de689e13e99bbaca73447239
stream_104_off000e10b5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE10B5 172604 bytes
SHA-256: d8cf7994976dd87814b2367880b5b7b5b41c59bdee8320feefc7b9c811ed3b4c
stream_110_off001166b7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1166B7 193940 bytes
SHA-256: 43efc962a27c4e4fd03cb76acc9d2fcbddd1e5891d0a6fbe0b08ec9502889d8d
font_00_sfnt_off000bcaab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBCAAB 231568 bytes
SHA-256: 86154d656d1730786e4d5190a60d2f2465dd6db811122ca16c2a2acbe2829c3b
font_03_sfnt_off000f04b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF04B4 176876 bytes
SHA-256: 4f85acd93427caee6c99e257879ce691dcaaf254f8b29a291ffddc7cedb4dfaf
font_04_sfnt_off001005ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1005BA 187728 bytes
SHA-256: 947033a2dffa57fc5ce010f3abfe2bee837c1048996317af6486e1d1090a8373
font_06_sfnt_off00123ed8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x123ED8 45060 bytes
SHA-256: fab7807ac31d50f1e0c1429f462516de7d92500dc24f0bac48246adf8e5e714a
font_07_sfnt_off001281f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1281F2 24904 bytes
SHA-256: 65e118ac48fd119abb2909936dae12d53424a6a5cedf20c09ff5d38e82db38f5
font_08_sfnt_off0012b471.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B471 165836 bytes
SHA-256: 193f08202ed00edcd6b68bdd34b63914c25b2b9648edf428c16880bbbc332232
font_09_sfnt_off0013e11c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E11C 254624 bytes
SHA-256: 7eacca6662d6909a6e90a61329396011c1096597ff45933b4555ddaa92c4f4ff
font_10_sfnt_off001591e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1591E0 28148 bytes
SHA-256: 2428df7e6a90edacd13c8fa289741db4114ab71d9b49ef4366576a244d44c684
font_11_sfnt_off0015c740.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15C740 185428 bytes
SHA-256: 130655b0169cd5ac2213eec7368bbdaf120e326bf2ce9e82b76e2eceacf0180d
font_12_sfnt_off001685ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1685BA 56392 bytes
SHA-256: 478a767dbb3a537ce3ab79dd79374663899ffeef10277163712281d4d875f429

Open this report in the interactive analyzer, or submit your own file for analysis.