PDF / .VIR static analysis report

Static analysis result for SHA-256 b3002626a64d7ac7…

CLEAN

PDF / .VIR

571.3 KB Authoring application: ilovepdf.com First seen: 2024-04-16
MD5: e031b7301a13199d8b1d3e29b5b38293 SHA-1: 725764f19b0433975711b703307056c1d8ad366e SHA-256: b3002626a64d7ac78abdfd6f2e734815f00f2b06d618cf831c29972cf79eaee7
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H In extracted file (stream_002_off00018653.bin)
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In extracted file (stream_002_off00018653.bin)
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn extracted file (stream_002_off00018653.bin)
    • http://www.microsoft.com/pki/certs/tspca.crt0In extracted file (stream_002_off00018653.bin)
    • http://www.microsoft.com/typographyIn extracted file (stream_002_off00018653.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (font_02_sfnt_off0002ce8f.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (font_02_sfnt_off0002ce8f.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00018653.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18653 233972 bytes
SHA-256: 79d9d8bc1c8f0fc5d48d574cce2647910002e87db1b87ab38b77b575c1d98f00
stream_005_off0003fe12.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3FE12 182836 bytes
SHA-256: b651b5c0c184f05a3412a2ec9eefdd71cfb0c274eb1d367a9d82158cef75872c
stream_007_off00051091.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51091 202096 bytes
SHA-256: 009012a85870dc0f28feef35fcdb42af146aa32204dfc4e95a81e514b838d006
font_00_sfnt_off000000a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3 252816 bytes
SHA-256: 9d14e5e44f448c9ae99b7d1f14436daafef4ea61675eccbb611388775a06ed64
font_02_sfnt_off0002ce8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CE8F 169476 bytes
SHA-256: a6eacb5f4c318f191f5c7ef56b8a9d24965db43dd12e86dc8eafc984e1163d47
font_05_sfnt_off0007438f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7438F 160244 bytes
SHA-256: 7c51d71e9a79091cde31bfcbaf39f9a54561886a318409cdb427e24fb01ae3fe

Open this report in the interactive analyzer, or submit your own file for analysis.