PDF / .VIR static analysis report

Static analysis result for SHA-256 9b514435475c53a8…

CLEAN

PDF / .VIR

493.9 KB Created: 2016-08-05 21:11:34 -04:00 Authoring application: Microsoft® Word 2010 First seen: 2024-11-21
MD5: 0707289b8717984a137890a31fc0c17b SHA-1: 2c83e2e7a0a2cf4aee3b6999c835dcf6820df77e SHA-256: 9b514435475c53a8e51d5ab7cf517f189d6d8ae0af7ba470fb01d7de7eab3a96
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://statinja.gov.jm/PressReleases.aspx In PDF document text
    • http://www.pioj.gov.jm/Portals/0/Social_Sector/OVERVIEW%20JSLC%202010.pdfIn PDF document text
    • http://www.commonwealthfoundation.com/sites/cwf/files/downloads/MDG%20Reports%20Jamaica_FINAL_2.pdfIn PDF document text
    • http://jis.gov.jm/jamaica-must-eliminate-hivaids-stigma-pm/In PDF document text
    • http://www.commonwealthfoundation.com/sites/cwf/files/downloads/MDG%20Reports%20JamaiIn PDF document text
    • http://ocsp.verisign.com0In extracted file (font_04_sfnt_off000623c9.bin)
    • http://www.imf.org/external/pubs/cat/longres.aspx?sk=43463.0PDF link annotation
    • http://www.insightcrime.org/search?q=jamaicaIn PDF document text
    • http://jamaica-gleaner.com/gleaner/20131112/lead/lead3.htmlIn PDF document text
    • http://jamaica-gleaner.com/gleaner/20120408/lead/lead10.htmlIn PDF document text
    • https://www.google.com/?gws_rd=ssl=Final+Evaluation%2C+Rural+Youth+Employment+Project%2C+jamaicaIn PDF document text
    • https://erc.undp.org/evaluation/documents/download/7540In PDF document text
    • http://epi.yale.edu/country/jamaicaIn PDF document text
    • https://www.google.com/?gws_rd=ssl=Final+Evaluation%2C+Rural+Youth+In PDF document text
    • https://erc.undp.org/evaluation/documents/In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_036_off00032c7a.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_036_off00032c7a.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn extracted file (stream_036_off00032c7a.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In extracted file (stream_036_off00032c7a.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_036_off00032c7a.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_036_off00032c7a.bin)
    • http://www.microsoft.com/Typography/0In extracted file (stream_036_off00032c7a.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_04_sfnt_off000623c9.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_04_sfnt_off000623c9.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_04_sfnt_off000623c9.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_04_sfnt_off000623c9.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_04_sfnt_off000623c9.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_04_sfnt_off000623c9.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_04_sfnt_off000623c9.bin)

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_036_off00032c7a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32C7A 224144 bytes
SHA-256: 890b82f8523118d8f6860ebd5029288b3009d575f83e0707f1e7dc83eb1e80cc
stream_038_off00045552.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x45552 208256 bytes
SHA-256: d7c052c822318a282fc548fdc986f8ecc808490974d220bf820cf5d5866f4423
stream_041_off000551c9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x551C9 166232 bytes
SHA-256: d1d39bca87179716a99def10b0aa02648b8882ab6ae68434df1c1e9ea3745c53
stream_044_off0006542d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6542D 178216 bytes
SHA-256: 0b658ed1d3a64c9934520e8216c3cfefa015d69aea175847fe5e09b7cbc3f70d
font_02_sfnt_off00054b14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54B14 3940 bytes
SHA-256: ac5eb0c13cece3d681db049be14b727f97fd6c5f3c64e9b0a16c086e205b7ab2
font_04_sfnt_off000623c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x623C9 24332 bytes
SHA-256: ca6c494bb5ef9be7361cfad38425c9e5ec46bc51a29f0a9ed3e0b4866540a7f4