PDF / .VIR static analysis report

Static analysis result for SHA-256 a49677d030f10c9a…

SUSPICIOUS

PDF / .VIR

323.6 KB Created: 2023-06-05 11:46:26 Authoring application: LibreOffice Draw First seen: 2024-10-26
MD5: 505eb52aaf0c6dc189e1c3b6f454875c SHA-1: 7f575a548c648939a6b408303e436eafee2ff687 SHA-256: a49677d030f10c9a4b323351d41ecd7cced03ffdcb7a3fe8a0f3522ed19b1b12
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9826

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cs-2-safe-manual.soforso.com/49271374527.pdf PDF link annotation
    • https://captain-america-comic-book-1.evileyecharm.com/dotezekiranuro.pdfIn PDF document text
    • https://daniel-negreanu-new-book.evileyecharm.com/47595544371.pdfIn PDF document text
    • https://le-trait-d-atheologie-epub-gratuit.beaute-a-porter.com/wopiva.pdfIn PDF document text
    • https://book-of-genesis-chapters-summary.soforso.com/45377109521.pdfIn PDF document text
    • https://booker-t-washington-impact-on-the-world.marieschefssoap.com/nezuto.pdfIn PDF document text
    • https://bemer-pro-set-english-instruction-manual.biaremodelor.org/13169074006.pdfIn PDF document text
    • https://how-many-books-is-lord-of-the-rings.davidsaffir.com/wagepeb.pdfIn PDF document text
    • https://brand-manual-egotype.mlgnbit.com/dalisatubezegu.pdfIn PDF document text
    • https://livre-de-cardiologie-pdf-gratuit.yaguecf.com/lugusuperinosaposodad.pdfIn PDF document text
    • https://desantis-removes-books-from-schools.biaremodelor.org/gorelumulujilegemiro.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f85130d5009b4823c19bcd/6549df813c21ce95a333e0b4_nawigebadusa.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edfc81304751b3ba7bd93e/6549dfcf9fa4aa44fe68df47_66407723686.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64f1b20def55fdc96a25af30/6549e05fc838dad1e64a2167_13732966212.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004986f.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004986f.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004986f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4986F 10364 bytes
SHA-256: 9a0d376e4d2ca6f6c31faeca6c6a85cfee2694f974b9dbd8a68b05509d3f1911
font_01_sfnt_off0004afcc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AFCC 37628 bytes
SHA-256: f1c7e80318ee7c1923e7c13a6d105f69874bead83c0b695ef06e6903d725ebc6

Open this report in the interactive analyzer, or submit your own file for analysis.