PDF / .VIR static analysis report

Static analysis result for SHA-256 aaea814f910c9e0f…

CLEAN

PDF / .VIR

123.3 KB Created: 2024-12-06 16:26:09 +00:00 Authoring application: mPDF 7.1.6 First seen: 2024-12-09
MD5: 50bef999fa7d340e27843fae87b8b879 SHA-1: 51da2e5a98d58b3dd07f63cac85a0098f6cadb4c SHA-256: aaea814f910c9e0fd0f48a7008f9cbce5fd3efde257f84ebd5bb70818c24506e
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lowmp3.com/other/179891-wet-socks-new-crush-45.html PDF link annotation
    • https://lowmp3.com/file.php?fn=V2V0IFNvY2tzIC0gTmV3IENydXNoIDQ1IChNUDMp&a=cmFy&s=MTkxMCBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=V2V0IFNvY2tzIC0gTmV3IENydXNoIDQ1IChGTEFDKQ%3D%3D&a=cmFy&s=MTIyNCBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=V2V0IFNvY2tzIC0gTmV3IENydXNoIDQ1IChXTUEp&a=cmFy&s=MTU0NCBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/file.php?fn=V2V0IFNvY2tzIC0gTmV3IENydXNoIDQ1&a=bXAz&s=MTkxMCBtYg==&i=L2ltYWdlcy9ub2ltYWdlLmpwZw==&h=bG93TVAzLmNvbQ==In PDF document text
    • https://lowmp3.com/funk-soul/362422-the-ideals-knee-socks-and-gorillas.pdfIn PDF document text
    • https://lowmp3.com/other/347162-name-science-sweet-science.pdfIn PDF document text
    • https://lowmp3.com/electronic/323232-gen-26-science-fiction-is-tomorrows-future.pdfIn PDF document text
    • https://lowmp3.com/electronic/313702-diction-djtwinky-dj-off-your-socks.pdfIn PDF document text
    • https://lowmp3.com/other/304812-social-distortion-hard-knocks-and-white-socks.pdfIn PDF document text
    • https://lowmp3.com/rock/291194-the-luxembourg-signalsoft-science-dying-star-cirrusbreaking.pdfIn PDF document text
    • https://lowmp3.com/electronic/213933-socks-and-sandals-schneetopfit.pdfIn PDF document text
    • https://lowmp3.com/electronic/96041-dream-art-science-hydrogen-burning.pdfIn PDF document text
    • https://lowmp3.com/hip-hop/87839-unconventional-scienceaesop-rock-bazooka-science.pdfIn PDF document text
    • https://lowmp3.com/rock/76896-infinity-crushabi-reimold-wish-it-stopped.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_002_off00002120.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_002_off00002120.bin)
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002120.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2120 19824 bytes
SHA-256: b5a056ebcfa63b81c85d4fd1ac3bc6fe76845c50664add9735242967184c2e9d
font_01_sfnt_off000054ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54EF 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off000088f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x88F5 20744 bytes
SHA-256: ab9666b9f147c093cc7c0c3c380f24e774adac11c1438a5fee417503cb83a37a
font_03_sfnt_off0000c11d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC11D 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1

Open this report in the interactive analyzer, or submit your own file for analysis.