PDF / .VIR malware analysis — suspicious · aac419a7243965f0

SUSPICIOUS

PDF / .VIR

325.2 KB Created: 2023-09-13 07:37:04 Authoring application: pdf-parser First seen: 2024-04-09

MD5: 521a71d4321d93dca7aec70d17dc28d9 SHA-1: 2978afe8ac06a1ba2b593c2c4af50247b8f908a2 SHA-256: aac419a7243965f0f10a07518268052d879a6407241924beb99d4762d3f02b63

36 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5758

Heuristics 3

External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://adservice.google.com.om/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/4c727c70-5d54-444e-8d6b-f4b0a5755fcf/downloads/panera_bread_menu_nutrition.pdf PDF link annotation
- https://adservice.google.com.pe/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/1a60eabd-2fe6-4740-8678-12415bcda3d4/downloads/63735362202.pdfIn PDF document text
- http://baca-grande-property-owners-association.echoearth.com/lewavonaj.pdfIn PDF document text
- https://adservice.google.com.ni/ddm/clk/445204615;249060672;c;;%3F//rawapozot.rebedopu.cfd/ruvezebijopujedu.pdfIn PDF document text
- https://adservice.google.co.ck/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/xozupebudagobafup.pdfIn PDF document text
- https://mahabharata-stories-in-telugu-pdf.jensenholland.net/mutuxivavimizemarur.pdfIn PDF document text
- https://adservice.google.com.et/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/4c727c70-5d54-444e-8d6b-f4b0a5755fcf/downloads/ketexuw.pdfIn PDF document text
- https://map-of-mazatlan-mexico.tubedeb.cfd/266.pdfIn PDF document text
- https://adservice.google.com.sl/ddm/clk/310682673;138356009;g;;%3F//img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/16215877040.pdfIn PDF document text
- http://set-an-alarm-for-2-45.stjosephcanonlaw.org/51.pdfIn PDF document text
- https://adservice.google.com.ag/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/mexonarufese.pdfIn PDF document text
- http://adservice.google.cf/ddm/clk/408405163;208572896;n;;%3F//apostila-ibge-efetivo-pdf-gr-tis.studioatdania.com/wimujelexisalow.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/canva_graphic_design_mod_apk.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/hack_pes_2020_android_terbaru.pdfIn PDF document text
- https://adservice.google.ga/ddm/clk/448794861;252804937;a;;%3F//img1.wsimg.com/blobby/go/727ed8d6-f739-4765-8260-bfc38531cd3f/downloads/20561041723.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/rusafomuwinadimobejudo.pdfIn PDF document text
- https://adservice.google.dj/ddm/clk/424929466;226923624;r;;%3F//img1.wsimg.com/blobby/go/1a60eabd-2fe6-4740-8678-12415bcda3d4/downloads/sixevabuzexezejufigola.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/4c727c70-5d54-444e-8d6b-f4b0a5755fcf/downloads/20030583185.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/98209766484.pdfIn PDF document text
- https://adservice.google.it/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/vitality_high_energy_dog_food_feeding_guide.pdfIn PDF document text
- https://adservice.google.at/ddm/clk/295204063;122181591;w;;%3F//img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/35775599651.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/8fab0d98-5d97-4fed-ba71-a1c166718459/downloads/80401293676.pdfIn PDF document text
- https://adservice.google.com.ua/ddm/clk/426382440;228185261;d;;%3F//img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/gaxamizokopozipem.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/trial_balance_worksheet_template.pdfIn PDF document text
- https://adservice.google.lt/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/80322375535.pdfIn PDF document text
- https://adservice.google.si/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/1527765635.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/75799363039.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/727ed8d6-f739-4765-8260-bfc38531cd3f/downloads/76214159362.pdfIn PDF document text
- https://adservice.google.ee/ddm/clk/478229754;284365575;c;;%3F//img1.wsimg.com/blobby/go/727ed8d6-f739-4765-8260-bfc38531cd3f/downloads/lunonovadudibe.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/punaribuzalumigebofasura.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/98580485823.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/8fab0d98-5d97-4fed-ba71-a1c166718459/downloads/99127632988.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/946cc29a-d267-422c-b9aa-6f5021159381/downloads/rijof.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/dc4395b9-3987-4054-a078-330d37312706/downloads/traffic_rider_mod_apk_android_4.2.2.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/988c0021-e131-496b-8725-ae310052894b/downloads/26005591213.pdfIn PDF document text
- http://adservice.google.si/ddm/clk/425484003;227454619;f;;%3F//the-love-prescription-pdf.airbrushking.org/kogimasijibebo.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/74b93a54-a345-47d6-92c2-c337da8a2a77/downloads/57470668171.pdfIn PDF document text
- https://adservice.google.ae/ddm/clk/445204615;249060672;c;;%3F//img1.wsimg.com/blobby/go/8fab0d98-5d97-4fed-ba71-a1c166718459/downloads/gevebalafagezimajevo.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/1a60eabd-2fe6-4740-8678-12415bcda3d4/downloads/60487824110.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004c7f0.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004c7f0.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0004c7f0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4C7F0	23944 bytes
SHA-256: `0ac6ded0957faff1b436c49d397b9921db747862322c45b35062bcc5ff6ef90d`

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF / .VIR

Machine Learning

Heuristics 3

Related samples 8

Extracted artifacts 1