Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 9b5db434e619892f…

MALICIOUS

PDF / .VIR

5.60 MB First seen: 2026-01-29
MD5: a5bb3726d32ceedabffebca2723b9264 SHA-1: 66124968828785a350a0f39442f42a09291c3119 SHA-256: 9b5db434e619892f9df2e55987bb5a6da43cc6ff1700264ee0d03db16190fb0a
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0120

Heuristics 3

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.novigradsarajevo.ba/public_html/obrasci/Profil_Opcine_Novi_Grad_Sarajevo.pdf In PDF document text
    • http://www.novigradsarajevo.ba/public_html/obrasci/STRATESKI%20DOKUMENTI/Strategija_razvoja_opcine_Novi_GraIn PDF document text
    • http://www.novigradsarajevo.ba/public_html/obrasci/STRATESKI%20DOKUMENTI/Lokalni_akcioni_plan_za_okolis_NovIn PDF document text
    • http://zpr.ks.gov.ba/sites/zpr.ks.gov.ba/files/Operativni%20program%20lokalnog%20ekonomskog%20razvoja%20opcine%2In PDF document text
    • http://www.fzzpr.gov.ba/In PDF document text
    • http://www.fzs.ba/godsnji_bilteni.htmIn PDF document text
    • http://www.judzks.ba/Domovizdravlja/NoviGrad.aspxIn PDF document text
    • http://www.judzks.ba/Domovizdravlja/NoviGrad.aspx#predskolIn PDF document text
    • http://mpz.ks.gov.ba/sites/mpz.ks.gov.ba/files/Skraceni%20REGISTAR%20KS.pdfIn PDF document text
    • http://80.65.164.218/izvjestaji/Izvjestaj%20o%20pracenju%20kvaliteta%20zraka%20na%20podrucju%20Kantona%20SarajeIn PDF document text
    • http://cipa.jp/exif/1.0/In PDF document text
    • http://ocsp.verisign.com0In extracted file (font_18_sfnt_off0050b96d.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/t/pg/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/Dimensions#In PDF document text
    • http://ns.adobe.com/xap/1.0/g/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.typography.com/FSTypeIn extracted file (font_01_cff_off000040b4.bin)
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn extracted file (font_04_sfnt_off00137522.bin)
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In extracted file (font_04_sfnt_off00137522.bin)
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn extracted file (font_04_sfnt_off00137522.bin)
    • http://www.microsoft.com/pki/certs/tspca.crt0In extracted file (font_04_sfnt_off00137522.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_04_sfnt_off00137522.bin)
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comYouIn extracted file (font_05_sfnt_off0027c90c.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_05_sfnt_off0027c90c.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (font_06_sfnt_off0042e634.bin)
    • http://www.microsoft.com/typography/0In extracted file (font_07_sfnt_off004454ce.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/YouIn extracted file (font_18_sfnt_off0050b96d.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_18_sfnt_off0050b96d.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_18_sfnt_off0050b96d.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OIn extracted file (font_18_sfnt_off0050b96d.bin)
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0In extracted file (font_18_sfnt_off0050b96d.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn extracted file (font_20_sfnt_off00517dd7.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_20_sfnt_off00517dd7.bin)
    • http://www.microsoft.com/typography/fonts/In extracted file (font_22_sfnt_off005349c4.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 26

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_026_off0012c2bd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12C2BD 19327 bytes
SHA-256: 316e6a061176dcf06430838f75469e33bb360fc3023ff92f73b97990ce641385
stream_117_off0023043f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x23043F 85140 bytes
SHA-256: 8a73a356b640345eacc2a54de677bd860bc0581f32996f6ce1213095073ad40f
font_00_sfnt_off00001f56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F56 16644 bytes
SHA-256: 56894b15237c8e8025e2744202801be6f1fc613e80f0441b6f133cda22399a84
font_01_cff_off000040b4.bin pdf-font-stream PDF embedded font (cff) at offset 0x40B4 1258 bytes
SHA-256: fc562280bfa126a0f4fd6e794bab2745565e8d3ef2324d231b9a44e5cf94cb0e
font_02_sfnt_off000046d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46D7 17688 bytes
SHA-256: d3d56035003858ae895923e14f3d7271c9dfaf47801e17d9f4e6cc5597dd01a6
font_03_sfnt_off00006ae3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6AE3 18519 bytes
SHA-256: 100cd95e4269e343e4641f8fd923bf6329bd2f54ce4590dc53ae897f7c91f0ed
font_04_sfnt_off00137522.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137522 56804 bytes
SHA-256: 15edbd3d172a16892dd83b7e90da0fd4fe04b430044012f42794d2fcdfd59297
font_05_sfnt_off0027c90c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27C90C 250296 bytes
SHA-256: 32b44caffb4e4c6bd0310c1cce429d780c662acb045ae70fa25cd68d4365f379
font_06_sfnt_off0042e634.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42E634 197440 bytes
SHA-256: b1a1fa8f6e47e05056e185903285628fbb98a31ef1fd7c41bb650ec350cae289
font_07_sfnt_off004454ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4454CE 223324 bytes
SHA-256: 323df13ac8ae075e5b4a87d22cdb63bd86d439bb2ace536c3f048708ee57d2d8
font_08_sfnt_off00460cc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x460CC2 229260 bytes
SHA-256: 619955e73b6a6e4bb263ad0b23f0fc2fcd4d75c2eb57f9cf894fdb9b1f2f4ce2
font_09_sfnt_off00473ffd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x473FFD 213928 bytes
SHA-256: 02f4f7823e42368730f0566336971acb6c875bb2c9f46e55dcd12127334e677b
font_10_sfnt_off00484dd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x484DD3 221668 bytes
SHA-256: d3e7865e0cd22a9b30678a2db8d3c5b097242c2b1bca344e8388ced600706e87
font_11_sfnt_off0049d06b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x49D06B 175320 bytes
SHA-256: b46cd27331040ada1cd077711b450afa982465f47f784afd623f60d27fa569f2
font_12_sfnt_off004b1fea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B1FEA 189500 bytes
SHA-256: 879863d7d9907d5df636d192e93ddf4660b625ab4798c7e8bcb987eac0ac206a
font_13_sfnt_off004c8d5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C8D5F 211292 bytes
SHA-256: fefc042708a4adc6effe2ecb2b45015bfebf4ece33cd90df59d7247fd0c88433
font_14_sfnt_off004d8d6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D8D6B 142564 bytes
SHA-256: ef039a7f9c2b2c1bc46ab08f7d7f6b3a407262107f8566763a9bccde0d6a9c60
font_15_sfnt_off004e2233.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4E2233 173048 bytes
SHA-256: 080b6a3ea6893055071612d429fcefcc5cd9bca1e236389a096aa15b5d5c685e
font_16_sfnt_off004f06ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F06ED 162684 bytes
SHA-256: 004e7da7f0ba017b81fdcf8c7e8287390419640f5809bb2b3c4152ceceb086d4
font_17_sfnt_off004fcf51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4FCF51 203156 bytes
SHA-256: 316c290c8ad7e523c38ab79c7b4a08c7890caed1740c91e2f0a4d7618a94e55c
font_18_sfnt_off0050b96d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50B96D 28076 bytes
SHA-256: 2bff52f0ee136f42dae64f1287bed0b4858e82c4f089ce000cb0d3a6fb53d440
font_19_sfnt_off0050ee7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50EE7D 141364 bytes
SHA-256: 956a6b08f9032d2304194f4b1b7fbe3dd20bc5f926035aad2d39463a7e2bac99
font_20_sfnt_off00517dd7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x517DD7 24332 bytes
SHA-256: ca6c494bb5ef9be7361cfad38425c9e5ec46bc51a29f0a9ed3e0b4866540a7f4
font_21_sfnt_off0051bbb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51BBB9 204852 bytes
SHA-256: cba1982b4f483aab6337da4912e7683e76b1715b24a673321814e6f31614f4f7
font_22_sfnt_off005349c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5349C4 51024 bytes
SHA-256: 0382bc836ffca41bddeaa8988c5b9f389be9f0aafca8f7f0cef11e9ad9d461c8
font_23_sfnt_off00538d7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x538D7A 68108 bytes
SHA-256: 4f4ee9c1b9353490973b5ad01bd30622db3551ae7d72d736fb3c0c75528d1a2c

Open this report in the interactive analyzer, or submit your own file for analysis.