Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 a1051a71cda31fca…

MALICIOUS

PDF / .VIR

156.4 KB Created: 2009-08-21 16:38:17 -04:00 Authoring application: Acrobat PDFMaker 7.0 for Word (via Acrobat Distiller 7.0 (Windows)) First seen: 2024-11-17
MD5: fc690018df6c8540882abea5b1a92b7c SHA-1: 07394c04896dbae8d6ab96670742ca4bb75d1edb SHA-256: a1051a71cda31fcad7411acde1e55fe85e563b9f4c2bb2af025736789b45dffb
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off000049b8.icc)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off000049b8.icc pdf-icc-profile PDF ICC profile at offset 0x49B8 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off0000608b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x608B 3508 bytes
SHA-256: a121fa5dba1b82eb481465539f36454eb253912edaa55b4ba03553792340908c
font_01_sfnt_off000227f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x227F3 28072 bytes
SHA-256: 72d3c395a65f4651cceed097fbf918ae5697e99a5954e6c7ebd09c6544ef77f9
font_02_sfnt_off00025057.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25057 3372 bytes
SHA-256: bb9b96488220de872967c9be4e554d2cb815de99842156af79b52870268fd110

Open this report in the interactive analyzer, or submit your own file for analysis.