PDF / .VIR static analysis report

Static analysis result for SHA-256 8aef55657f94d643…

CLEAN

PDF / .VIR

469.0 KB Created: 2014-05-15 10:28:20 +08:00 Authoring application: Microsoft® Word 2010 First seen: 2024-07-31
MD5: 065ce8be06679dba5eeb8e9e947c0a56 SHA-1: bcbcebe50d8bb492f1e4dab9fdd533b72fc336e5 SHA-256: 8aef55657f94d6437eb8b75b57a2332951cf59c7cb34abf0fe55488dbe860148
2 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 In extracted file (font_03_sfnt_off0006e17e.bin)
    • http://dx.doi.org/10.15282/ijame.3.2011.11.0030In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn extracted file (stream_050_off00060ce3.bin)
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In extracted file (stream_050_off00060ce3.bin)
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn extracted file (stream_050_off00060ce3.bin)
    • http://www.microsoft.com/pki/certs/tspca.crt0In extracted file (stream_050_off00060ce3.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_050_off00060ce3.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_01_sfnt_off0004dc2c.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_03_sfnt_off0006e17e.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_03_sfnt_off0006e17e.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_03_sfnt_off0006e17e.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_03_sfnt_off0006e17e.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_03_sfnt_off0006e17e.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_03_sfnt_off0006e17e.bin)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_050_off00060ce3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x60CE3 163024 bytes
SHA-256: 9d79841deda18d79055ab36ef240fcfae02801d88e780d6f1a6263441108245b
font_00_sfnt_off0003b74b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B74B 222728 bytes
SHA-256: b88b505d5fd48485715c2b09f640ecaf5dffa04d14ab66f576693474907959d8
font_01_sfnt_off0004dc2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4DC2C 168868 bytes
SHA-256: 346d447c60325bab9db30abfb12df0c68fc2cadb13faad1c67605cab60510032
font_03_sfnt_off0006e17e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E17E 26716 bytes
SHA-256: d5be59b06324b0f165766f953398b0b5f88a074bd3daf4e5beb231a793b51e6f
font_04_sfnt_off00072699.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72699 2736 bytes
SHA-256: 49246b1092b9f9f0e1744fb207e050524952a488b87ff9660c5ce8bfa1a2a4c0

Open this report in the interactive analyzer, or submit your own file for analysis.