PDF / .VIR static analysis report

Static analysis result for SHA-256 92dd344e937fa51f…

CLEAN

PDF / .VIR

849.7 KB Created: 2019-02-20 13:58:30 +00:00 Authoring application: Microsoft® Word for Office 365 First seen: 2024-04-16
MD5: f82961d6973352fce6123cabe32c5d79 SHA-1: c629e9e59d0ef2975045d2207f69784942d60416 SHA-256: 92dd344e937fa51f570e6c3a9b1e6c38f47113e5cb5336b2a9e885b33d8373f4
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 In extracted file (font_05_sfnt_off000ac60c.bin)
    • https://uk.wikipedia.org/wiki/%D0%9F%D1%80%D0%B8%D1%80%D0%BE%D0%B4%D0%BD%D0%B8%D1%87%D0%B0_%D0%BD%D0%B0%D1%83%D0%BA%D0%B0PDF link annotation
    • https://uk.wikipedia.org/wiki/%D0%94%D0%BE%D1%81%D0%BB%D1%96%D0%B4%D0%B6%D0%B5%D0%BD%D0%BD%D1%8FIn PDF document text
    • https://uk.wikipedia.org/wiki/%D0%A4%D1%96%D0%B7%D0%B8%D1%87%D0%BD%D0%B5_%D1%8F%D0%B2%D0%B8%D1%89%D0%B5In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%9D%D0%B0%D1%83%D0%BA%D0%B0In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%9F%D1%80%D0%B8%D1%80%D0%BE%D0%B4%D0%B0In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%A4%D1%96%D0%B7%D0%B8%D0%BAIn PDF document text
    • https://uk.wikipedia.org/wiki/%D0%92%D0%BB%D0%B0%D1%81%D1%82%D0%B8%D0%B2%D1%96%D1%81%D1%82%D1%8CIn PDF document text
    • https://uk.wikipedia.org/wiki/%D0%9C%D0%B5%D0%B6%D0%B0In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%95%D0%BB%D0%B5%D0%BC%D0%B5%D0%BD%D1%82%D0%B0%D1%80%D0%BD%D0%B0_%D1%87%D0%B0%D1%81%D1%82%D0%B8%D0%BD%D0%BA%D0%B0In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%A4%D1%96%D0%B7%D0%B8%D0%BA%D0%B0_%D0%B5%D0%BB%D0%B5%D0%BC%D0%B5%D0%BD%D1%82%D0%B0%D1%80%D0%BD%D0%B8%D1%85_%D1%87%D0%B0%D1%81%D1%82%D0%B8%D0%BD%D0%BE%D0%BAIn PDF document text
    • https://uk.wikipedia.org/wiki/%D0%92%D1%81%D0%B5%D1%81%D0%B2%D1%96%D1%82In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%A1%D0%B8%D1%81%D1%82%D0%B5%D0%BC%D0%B0In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%9A%D0%BE%D1%81%D0%BC%D0%BE%D0%BB%D0%BE%D0%B3%D1%96%D1%8FIn PDF document text
    • https://uk.wikipedia.org/wiki/%D0%9C%D0%B0%D1%82%D0%B5%D1%80%D1%96%D1%8F_In PDF document text
    • https://uk.wikipedia.org/wiki/%D0%97%D0%B0%D0%BA%D0%BE%D0%BD_In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_079_off0007ec4f.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_079_off0007ec4f.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (stream_079_off0007ec4f.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (stream_079_off0007ec4f.bin)
    • https://www.microsoft.com/en-us/Typography/In extracted file (stream_079_off0007ec4f.bin)
    • http://www.microsoft.com/typography/ctfontshttp://lucasfonts.comMicrosoftIn extracted file (stream_084_off000a3b61.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (stream_084_off000a3b61.bin)
    • http://www.microsoft.com/Typography/0In extracted file (stream_084_off000a3b61.bin)
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comYouIn extracted file (stream_088_off000af398.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_05_sfnt_off000ac60c.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_05_sfnt_off000ac60c.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_05_sfnt_off000ac60c.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_05_sfnt_off000ac60c.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_05_sfnt_off000ac60c.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_05_sfnt_off000ac60c.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_05_sfnt_off000ac60c.bin)
    • http://www.microsoft.com/typography/fonts/In extracted file (font_07_sfnt_off000c1846.bin)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_079_off0007ec4f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7EC4F 120688 bytes
SHA-256: 1b7d9a671dfb5dba4b134638c13cd9373277eca5758685d062eb7943d0b21320
stream_083_off00098213.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x98213 96568 bytes
SHA-256: 4503261cddf6ada2b1a815856ce955b7bdd708efe7f5a1900cb3458a69b32da4
stream_084_off000a3b61.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA3B61 101760 bytes
SHA-256: 97c667a0e0d3a4c336c9aaf4ef5a058e8a2104aba1e4bf7aad43d9ccd2d76f3d
stream_088_off000af398.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xAF398 165548 bytes
SHA-256: 155221eb216227465337e6fb1b56d6c6d4b6e312bea30b03669372de93e33493
font_00_sfnt_off0006d8ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D8EF 130224 bytes
SHA-256: 45bf49b10ba5209dca5e69e0158e0a2d42ccb1d95e296c7244617b65742ca322
font_02_sfnt_off0008fe4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8FE4C 71580 bytes
SHA-256: 230fb79e02a2a61202f5f6cc8d58e9aeec86ab5c5826c8234abcf24d70809179
font_05_sfnt_off000ac60c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAC60C 17812 bytes
SHA-256: b132b8180c99c90e2eb0072ac05ee5c1a1e7b6abf663bf7888fd682cc81b0baf
font_07_sfnt_off000c1846.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC1846 38588 bytes
SHA-256: c9da5ff972a7ce673f167a2c39593c5aec861f97a7e32cd6f561bde153be02c7
font_08_sfnt_off000c6864.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6864 68468 bytes
SHA-256: e2ef6183018d58e806b127beddca3a3d819339855adf85ee52fe09b95c34257c

Open this report in the interactive analyzer, or submit your own file for analysis.