PDF / .VIR static analysis report

Static analysis result for SHA-256 bb26f9037f9da168…

SUSPICIOUS

PDF / .VIR

27.4 KB Created: 2021-06-01 05:54:59 UTC Authoring application: Softplicity First seen: 2025-01-08
MD5: 348ee6b9ee7ccc8d8c05c21acd7b29d7 SHA-1: 0f9140dcecfdb672a746eeb1c89844cf569adcf4 SHA-256: bb26f9037f9da16840291f10491af961538f44c38b66fff70988c8373ef43899
34 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2911

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5258633/normal_60b3fa708b1bd.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5258625/normal_60b3fc5b318c2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258627/normal_60b3f49472ca0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258636/normal_60b3f62eaf743.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f91f11fb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f67b20ac8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258625/normal_60b3fc3b77358.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f8114dc21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af1dc6823.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af63c0d38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af74c9d33.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af5277896.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5aeeb04ecb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af4082567.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af2ff21a6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261941/normal_60b5af8660ac7.pdfIn PDF document text
    • http://med.litd.icu/dls.php?q=Klippo+Brilliant+S+ManualIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: f-static.net 4 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.