PDF / .VIR static analysis report

Heuristics 4

• TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
  PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
• Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• External URI info PDF_URI
  PDF contains an external URL action
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://gosciencegirls.com/ In PDF document text

  • https://aenert.com/news-events/industrial-tours/n/15-years-of-the-first-commercial-concentrating-solar-power-plant-ps10/In PDF document text
  • https://synhelion.com/In PDF document text
  • https://wwww.microsoft.com0In extracted file (stream_041_off0048b779.bin)
  • https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.mdIn extracted file (font_00_sfnt_off0048894f.bin)
  • http://www.paratype.com/publicIn extracted file (font_05_sfnt_off004be15e.bin)
  • http://www.paratype.com/help/designers/http://scripts.sil.org/OFL_webIn extracted file (font_05_sfnt_off004be15e.bin)
  • http://ocsp.verisign.com0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://ocsp.thawte.com0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://www.paratype.comIn extracted file (font_05_sfnt_off004be15e.bin)
  • http://www.ascendercorp.com/typedesigners.htmlLicensedIn extracted file (font_11_sfnt_off004e3a40.bin)
  • http://ocsp.verisign.com01In extracted file (font_11_sfnt_off004e3a40.bin)
  • https://www.linkedin.com/in/gianluca-ambrosetti-706210b4/PDF link annotation
  • https://www.linkedin.com/in/philipp-furler-phd-99b81556/In PDF document text
  • https://www.linkedin.com/in/hans-hess-a873ba2/In PDF document text
  • https://www.linkedin.com/in/thomassyfrig/In PDF document text
  • https://www.linkedin.com/in/philipp-good-176b66169/In PDF document text
  • https://x.com/RARohdeIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/pdfx/1.3/In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (stream_041_off0048b779.bin)
  • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_041_off0048b779.bin)
  • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_041_off0048b779.bin)
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pkiops/Docs/Repository.htm0In extracted file (stream_041_off0048b779.bin)
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In extracted file (stream_041_off0048b779.bin)
  • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn extracted file (stream_042_off0049b509.bin)
  • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In extracted file (stream_042_off0049b509.bin)
  • https://docs.microsoft.com/typography/aboutWeightWidthOpticalIn extracted file (font_00_sfnt_off0048894f.bin)
  • https://www.verisign.com/repository/CPS��In extracted file (font_04_sfnt_off004b9558.bin)
  • https://www.verisign.comIn extracted file (font_04_sfnt_off004b9558.bin)
  • https://www.verisign.com/repository/verisignlogo.gif0��In extracted file (font_04_sfnt_off004b9558.bin)
  • https://www.verisign.com/CPS0bIn extracted file (font_04_sfnt_off004b9558.bin)
  • http://www.microsoft.com/truetype/0In extracted file (font_04_sfnt_off004b9558.bin)
  • http://scripts.sil.org/OFLIn extracted file (font_05_sfnt_off004be15e.bin)
  • http://crl.verisign.com/tss-ca.crl0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://cs-g2-crl.thawte.com/ThawteCSG2.crl0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://crl.thawte.com/ThawtePCA.crl0In extracted file (font_05_sfnt_off004be15e.bin)
  • http://www.apache.org/licenses/LICENSE-2.0In extracted file (font_11_sfnt_off004e3a40.bin)
  • https://www.verisign.com/rpaIn extracted file (font_11_sfnt_off004e3a40.bin)

  +8 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.