PDF / .VIR static analysis report

Static analysis result for SHA-256 ce64252d168bfb94…

CLEAN

PDF / .VIR

325.6 KB Created: 2024-03-14 09:46:51 -04:00 Authoring application: Microsoft® PowerPoint® for Microsoft 365 First seen: 2025-01-08
MD5: 8ea82d9fde75787ac7ce55366da58c71 SHA-1: 9ca5d3b0398506acc85bcbc91298b80ee7af74ab SHA-256: ce64252d168bfb94d1043c2d9daaf901fe37784f17531cc63f902743b5fc6b58
2 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wwww.microsoft.com0 In extracted file (stream_013_off00020337.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn extracted file (stream_013_off00020337.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_013_off00020337.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_013_off00020337.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_013_off00020337.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_013_off00020337.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_013_off00020337.bin)
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_013_off00020337.bin)
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn extracted file (stream_013_off00020337.bin)
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In extracted file (stream_013_off00020337.bin)
    • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn extracted file (stream_016_off00031631.bin)
    • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In extracted file (stream_016_off00031631.bin)
    • http://www.microsoft.com/pkiops/Docs/Repository.htm0In extracted file (stream_016_off00031631.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In extracted file (stream_016_off00031631.bin)
    • http://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/designer/des_index.htmlIn extracted file (font_01_sfnt_off0002ea48.bin)
    • https://www.verisign.com/repository/CPS��In extracted file (font_01_sfnt_off0002ea48.bin)
    • https://www.verisign.comIn extracted file (font_01_sfnt_off0002ea48.bin)
    • https://www.verisign.com/repository/verisignlogo.gif06In extracted file (font_01_sfnt_off0002ea48.bin)
    • http://status.verisign.com/class1.crl0In extracted file (font_01_sfnt_off0002ea48.bin)
    • http://www.microsoft.com/truetype/0In extracted file (font_01_sfnt_off0002ea48.bin)

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_013_off00020337.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x20337 149808 bytes
SHA-256: 729d428ba9a1de100e8731bbd40bfb4b8dac776f0f9ddfe58d54342a209ced2e
stream_016_off00031631.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x31631 145232 bytes
SHA-256: 785252587b9afe2abb5dc974e235c173b840b98e96b28ab9173a44ed10d8f989
stream_021_off000495a6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x495A6 58580 bytes
SHA-256: 095cc313d9480f8269e16259e1fcf9a3aefbd6743cce9d9baa38de2be6bf7c9a
font_01_sfnt_off0002ea48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EA48 19744 bytes
SHA-256: 6c099fb0ab5d1893d29d9d92b3e36bb1e98de3ccf2f575fa6c59845f31617060
font_03_sfnt_off0003fa85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FA85 59128 bytes
SHA-256: f755bef8560eae3cdee657d6572580e080d104799c3eef06c7152d83d7ff398b
font_04_sfnt_off000440f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x440F1 66676 bytes
SHA-256: 2e82102597563860e7e4878a63c1ab20da79e7aa43df5c36a8c36cd93321b491

Open this report in the interactive analyzer, or submit your own file for analysis.