PDF / .VIR static analysis report

Static analysis result for SHA-256 9161ca64b0a5fe92…

SUSPICIOUS

PDF / .VIR

426.0 KB Created: 2023-11-01 21:20:36 Authoring application: Serif PagePlus First seen: 2024-10-24
MD5: 5f28009041b9a1a2c8f318963ba1e701 SHA-1: 27c05adb6f696d0c107740ac4931b3b024231b5b SHA-256: 9161ca64b0a5fe92e3e8166997ea1b36120cabd360220d1b9f7166301be60e8d
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7241

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://adservice.google.com.af/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/fc635392-61de-40bc-86f0-c9844fcf30fd/downloads/28724466762.pdf PDF link annotation
    • https://introductory-chemistry-9th-edition-pdf.jedermanns-donautal.de/jinufa.pdfIn PDF document text
    • https://adservice.google.com.vn/ddm/clk/424929466;226923624;r;;%3F//uploads-ssl.webflow.com/64f842bfc6b8a48c2a830a7c/6562cc06e79197d7d787f5d4_dixunosisaremalufesujew.pdfIn PDF document text
    • https://adservice.google.com.eg/ddm/clk/408405163;208572896;n;;%3F//uploads-ssl.webflow.com/64f1a2808421df3c8fca4758/6562cc622f3bb75b0b68e925_vajulopamixogobusobut.pdfIn PDF document text
    • https://adservice.google.com.my/ddm/clk/300948314;127869103;e;;%3F//uploads-ssl.webflow.com/64ee1d4008552c47a652db2c/6562cc296a2068e01dd16ad7_34421332607.pdfIn PDF document text
    • https://level-google-local-guide.brittanygroundhouse.com/mutebozex.pdfIn PDF document text
    • https://adservice.google.co.tz/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/d7328e9f-a911-42aa-a1c4-e6509f0a2e6a/downloads/6969929463.pdfIn PDF document text
    • https://adservice.google.com.tj/ddm/clk/424929466;226923624;r;;%3F//uploads-ssl.webflow.com/64edfdff2ac18b274452201b/6562cc59b0669b030c8ff0f0_jupilujonenil.pdfIn PDF document text
    • https://adservice.google.bi/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/0c132c72-7454-4019-8e3e-a2033dfbc7ee/downloads/bonadukerijewudowila.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/3dd84df9-c352-4052-ac04-876a2d311570/downloads/estrategia_em_midias_sociais_fabio_cipriani.pdfIn PDF document text
    • https://adservice.google.co.uk/ddm/clk/408405163;208572896;n;;%3F//img1.wsimg.com/blobby/go/0c132c72-7454-4019-8e3e-a2033dfbc7ee/downloads/49185902714.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/b2cf89f3-bcea-409c-8ebc-0040b7baacc8/downloads/nepewenupotita.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/c0a9034f-3c70-4668-bc18-2ed97321ec02/downloads/64400500728.pdfIn PDF document text
    • https://adservice.google.to/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/7137703f-3908-4264-88f8-aeeb63b613d0/downloads/wexili.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/ce95375b-48bc-4cd8-9883-aae87fd60b05/downloads/95992607770.pdfIn PDF document text
    • https://adservice.google.me/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/714673dd-eca2-4928-a1c2-090c1304c747/downloads/lafobefipokibixuba.pdfIn PDF document text
    • https://adservice.google.bt/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/50088168-dbcc-4059-98fb-64ab83c3d686/downloads/15698623521.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/7137703f-3908-4264-88f8-aeeb63b613d0/downloads/56178906795.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/0593cdf4-943b-4305-b995-8459f2a0b9b2/downloads/bodifefejolawososilis.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/ce95375b-48bc-4cd8-9883-aae87fd60b05/downloads/development_questions_and_answers.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/5a574e23-b6c3-4cbb-9908-81c9ac8b2e76/downloads/33835245128.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/0593cdf4-943b-4305-b995-8459f2a0b9b2/downloads/challenges_of_procurement_contract_management.pdfIn PDF document text
    • https://adservice.google.mu/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/7137703f-3908-4264-88f8-aeeb63b613d0/downloads/3rd_conditional_sentences_worksheets.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f857a823d25137622f1cbe/6562cc1075db541f49edd99e_73358882533.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edeb9fee622c5eaab1a35b/6562cc936bc7baf9b8427926_48637639603.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edfdff2ac18b274452201b/6562cc26c9018bf978d0a2f4_68384401469.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000653a0.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000653a0.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000653a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x653A0 17520 bytes
SHA-256: 24d8b18b0f99ad5c4d503a96190ede8b24cb798c88edbb70090776e999b34887
font_01_sfnt_off000680a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x680A0 10696 bytes
SHA-256: f6caf1bd993575cae2dc5012b2187bfc378a4054cc482bb2d8eb295950a054d0