PDF / .VIR static analysis report

Static analysis result for SHA-256 be0c63555056f866…

CLEAN

PDF / .VIR

703.5 KB Created: 2021-07-12 08:07:20 -04:00 Authoring application: Microsoft® PowerPoint® 2016 First seen: 2025-02-11
MD5: d4eabce7aaf9fb8586c75caedc3f73bb SHA-1: dde2eb5cc84d61941f604eb5e91eec96b771b742 SHA-256: be0c63555056f8663d52417d310ad6c669493928294d9003f5cba058af37e5af
2 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_054_off00086299.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (stream_054_off00086299.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_054_off00086299.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/TypographyIn extracted file (stream_054_off00086299.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/MicrosoftIn extracted file (font_02_sfnt_off00093273.bin)
    • http://www.microsoft.com/typography/fonts/In extracted file (font_04_sfnt_off00096005.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_054_off00086299.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x86299 110840 bytes
SHA-256: bdbe7cc6e65bbc21ea090ce3a3ac6f4ab29fd0ccd887cb482ddd6e98906a6a6c
font_00_sfnt_off0007c895.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C895 85768 bytes
SHA-256: a4096a915644ade9b5f8f908a75238f62d51c8e3d0ecb58f870e5c47929821c4
font_02_sfnt_off00093273.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93273 14180 bytes
SHA-256: ea845d0e384984a0e8aa4393bad66e7315b15e1268ef7990f53ffe81b10f0cb6
font_03_sfnt_off00094f0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x94F0C 6620 bytes
SHA-256: 52e3f2a3acd645df29972abdaadd7d05e2a5850b52e69e5de93e4addb56f91ff
font_04_sfnt_off00096005.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96005 53672 bytes
SHA-256: f265fec7ed8ba33c2c8895efc29bba0518b05df188ce9f8838791b58b2bb40aa
font_05_sfnt_off0009a627.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9A627 32080 bytes
SHA-256: f052cf4bf3e407f45fc61207bdd9da2edabbafe60b2090a1c03eeae616c245dc
font_06_sfnt_off0009c328.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C328 44088 bytes
SHA-256: c331bd4123b9731d19e2978d8b93ff589ef2984e15c99dd38f40d2b7994954df

Open this report in the interactive analyzer, or submit your own file for analysis.