PDF / .VIR static analysis report

Static analysis result for SHA-256 7e9dd26ea25b49df…

SUSPICIOUS

PDF / .VIR

28.3 KB Created: 2021-05-31 04:59:25 UTC Authoring application: Softplicity First seen: 2025-01-08
MD5: f26bc998cbf5962a6028b9ceae26e790 SHA-1: 3014bd4f027e5ef0c7d7d419ff15bafc3896cf00 SHA-256: 7e9dd26ea25b49df6b3371a02ceddab7e4772ef36bcb3b18bb8965a42cd637de
34 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2816

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5257872/normal_60b39e53ee049.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5257845/normal_60b3a705e97a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257848/normal_60b39b58db704.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257868/normal_60b3a4caeec84.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257760/normal_60b39d6cb5bd0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257845/normal_60b3a1e539cc8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257872/normal_60b3a13440cb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257806/normal_60b39fcccd973.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b445ed7a365.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b44a9778b89.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b450990efd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b45088a0035.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b45068f1241.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b45078f2663.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b448b56c64f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b44effae4c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b4505874e75.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5259022/normal_60b45047c9b7d.pdfIn PDF document text
    • http://hes.litd.icu/dls.php?q=9733+2011+Polaris+Rzr+800+S+4+Eps+Utv+Service+Repair+Manual+9733In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.