PDF / .VIR static analysis report

Static analysis result for SHA-256 bcfe259ca928c4d3…

CLEAN

PDF / .VIR

506.6 KB Created: 2017-11-24 02:33:37 +02:00 Authoring application: Microsoft® Office Word 2007 First seen: 2024-04-16
MD5: 27578bb0568f181be482ca057828d57e SHA-1: 213a0ca134b28a219d80dff6ed87859e6664beaf SHA-256: bcfe259ca928c4d33fdaef7abb83a1cbf7d644b1148fb362e2cba93a9db8d9f5
2 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X In extracted file (stream_048_off0002594f.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_048_off0002594f.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn extracted file (stream_048_off0002594f.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In extracted file (stream_048_off0002594f.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_048_off0002594f.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_048_off0002594f.bin)
    • http://www.microsoft.com/typography/0In extracted file (stream_048_off0002594f.bin)
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn extracted file (stream_051_off000460a8.bin)
    • http://www.microsoft.com/typography/fonts/default.aspxIn extracted file (stream_051_off000460a8.bin)
    • http://www.microsoft.com/typography/ctfontshttp://www.fonts.comYouIn extracted file (font_03_sfnt_off00059484.bin)
🗂 Part of campaign: shared payload 7e4af2d1a4 5 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_048_off0002594f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2594F 219404 bytes
SHA-256: d1f5d83835cbe74b71375532f289a412783a442c45f69757b6b2e23ad1b207d9
stream_050_off000381bc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x381BC 196348 bytes
SHA-256: ee951d95b7d05e3386890e01f5d3c548bf2aa074b3030a3d7d2bc1c942a1a8bd
stream_051_off000460a8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x460A8 170420 bytes
SHA-256: 7e4af2d1a4638e37259589c7fe3236dc59c6c0dd5fa327a291f1b3d7d415281f
font_03_sfnt_off00059484.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59484 257180 bytes
SHA-256: b5b68eec608962e23966594c5d7929ce7abe844513ee2b535dff734811635415

Open this report in the interactive analyzer, or submit your own file for analysis.