PDF / .VIR static analysis report

Static analysis result for SHA-256 ab815715b571a974…

SUSPICIOUS

PDF / .VIR

323.5 KB Created: 2023-07-02 15:39:10 Authoring application: pdf-parser First seen: 2024-10-24
MD5: c3cbc835bd2d27b1479db211f78622af SHA-1: 9ac92ec81f15f30b4399fd9d52d6a8ccb3dcb2c6 SHA-256: ab815715b571a974684f86a97573358f6edfbd79ba5c222826ee3bc58f0ceb1b
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8570

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://les-meilleurs-livres-pour-comprendre-la-philosophie.georgialapsurgery.com/58295493736.pdf In PDF document text
    • https://sony-hvl-f32m-manual.era-insurance.com/86929873546.pdfIn PDF document text
    • https://investments-bodie-kane-marcus-9th-edition-solutions-manual.vmoga.com/fajomesafiso.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/e6759127-6a8b-4c8d-94e6-ce0d4ddee816/downloads/80204378491.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/e3743f65-6875-49ef-87db-9c97db9bcff8/downloads/tulozirigulirabasi.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4495e0bd-5ab2-4004-8be1-e30ef3373564/downloads/77396194439.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4495e0bd-5ab2-4004-8be1-e30ef3373564/downloads/rules_for_direct_and_indirect_object_pronouns_in_spanish.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/159da013-e0ff-4e96-97d6-f3a265fad9df/downloads/39858224497.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/30618d60-0cef-4385-b792-800849c38b12/downloads/what_do_you_do_in_therapy_sessions.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/d5e97205-d745-471d-94c2-4bc94f943a29/downloads/vajife.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/159da013-e0ff-4e96-97d6-f3a265fad9df/downloads/87767368505.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4d02ebb2-e6cb-4939-adfe-e191eb1694dc/downloads/mixuworudusasazuxu.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/159da013-e0ff-4e96-97d6-f3a265fad9df/downloads/50938015526.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4d02ebb2-e6cb-4939-adfe-e191eb1694dc/downloads/tatedenizujarukudadofa.pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004d116.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004d116.bin)

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004d116.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D116 17084 bytes
SHA-256: cc804d27d97207ba9675e92f63f36b306c11822c8801c15a2b1c99014304f2da

Open this report in the interactive analyzer, or submit your own file for analysis.