Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 87a9e510bca4a3ac…

MALICIOUS

PDF / .VIR

6.52 MB First seen: 2026-03-03
MD5: e7971a885550a7f98c7049b6308129cd SHA-1: 787299e83174a15fead9a3cfb721faec07527dd4 SHA-256: 87a9e510bca4a3ac537a37a7819b5a727326c87914c840045d12158017bd3cab
96 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2916

Heuristics 7

  • JPXDecode + active content — JPEG2000 CVE-family indicator info CVE related PDF_JPX_CVE_2018_4990_RELATED
    PDF uses /JPXDecode (JPEG2000) alongside JavaScript, XFA, or RichMedia indicators. This matches the delivery pattern for Adobe Reader JPEG2000 parser exploit families, including CVE-2018-4990, but does not prove the exact malformed JP2/JPX primitive.
  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Launch action low PDF_LAUNCH
    PDF contains a /Launch action; all filespec targets are document files (cross-PDF navigation pattern, common in multi-part document bundles)
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wireshark.com In extracted file (objstm_1730_00.bin)
    • http://www.viavisolutions.com/en/services-and-support/support/technical-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.viavisolutions.com/termsPDF link annotation
    • http://www.iec.chIn extracted file (icc_00_off00532a77.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_6120_00.bin pdf-objstm-decoded PDF /ObjStm 6120 0 obj (inflated) 18175 bytes
SHA-256: 1e2f847309ac895ebb7f32b59f458444e9de190a144fe8e64317611c6dabad00
objstm_1730_00.bin pdf-objstm-decoded PDF /ObjStm 1730 0 obj (inflated) 662 bytes
SHA-256: 8791ece3e3b36c1783ed037ae578dcec6fe657c469e01e193c2312498b492dc1
icc_00_off00532a77.icc pdf-icc-profile PDF ICC profile at offset 0x532A77 3144 bytes
SHA-256: 3f6d674174f3804eb0dabdac90ae17486e898c5063a66f861c116ea033da8301
icc_01_off0057a8ee.icc pdf-icc-profile PDF ICC profile at offset 0x57A8EE 3920 bytes
SHA-256: 3adedd5e7520a6047b1fc81e79788707a67eaf24785aee9f0a21d608f38073a4
icc_02_off006149a6.icc pdf-icc-profile PDF ICC profile at offset 0x6149A6 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00004ad4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AD4 71448 bytes
SHA-256: aaacf5149d63d89df489ff2d5cbc67b80cc5b885b8af237ec2c47f69c41207c3
font_01_sfnt_off0001e64e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E64E 45370 bytes
SHA-256: f6619954fe714e528a7d4bf43c83fb91971268de00b69bd15eb4953f2ee3b0ec
font_02_cff_off003eb2ed.bin pdf-font-stream PDF embedded font (cff) at offset 0x3EB2ED 424 bytes
SHA-256: d16867661c223ce768c654da6734cb4b0fc385b0a735ef6b23d1f176142db1d2
font_03_cff_off004f7c59.bin pdf-font-stream PDF embedded font (cff) at offset 0x4F7C59 552 bytes
SHA-256: 8e22fc80ded854b6bf070654e5f6a3c14baa17feb328efcbdca8ac61cfbed712
font_04_sfnt_off005c2c72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C2C72 231367 bytes
SHA-256: 7d8442828c3daa86750aac78767d381e5b29bb5203764b56b64841422344f0b8
font_05_sfnt_off005f944e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F944E 91853 bytes
SHA-256: 6d8df0fba02691ba9c61f47046fc8325daf4f5d0865ec56d2136166802a04290
font_06_sfnt_off00608e44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x608E44 51391 bytes
SHA-256: d8252236300c7d237ce0a8da0a1c582b5b4f614fd6396957b312723a5e7b08f9
font_07_sfnt_off0060f342.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60F342 49996 bytes
SHA-256: 2718859db31fe86209a292c9b67ea2787987969e0105d9c3ce45468402e9facf
font_08_sfnt_off00624de8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x624DE8 36499 bytes
SHA-256: 09c7675772770c230d95c1b345d0342549ca4ece563644aea55eb772ad161076
font_09_sfnt_off0064bab8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64BAB8 60734 bytes
SHA-256: 644aabb7f2252cfc476d40afb6003a3b98834902584a3f87b893debb62a3c344

Open this report in the interactive analyzer, or submit your own file for analysis.