PDF / .VIR static analysis report

Static analysis result for SHA-256 d22ac68b78601107…

CLEAN

PDF / .VIR

470.1 KB Created: 2017-11-23 16:07:07 +01:00 Authoring application: Microsoft® Word 2010 First seen: 2024-07-29
MD5: aa029495890857cca8ba9aca38110ef4 SHA-1: 2168aa5a7fb760d7e4acd55c856536d9a33c8b25 SHA-256: d22ac68b78601107a1aff9f1fcabcb924ad5f794ef2ab705e1d284fa77910052
12 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • External URI low PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ocsp.verisign.com0 PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#PDF link annotation
    • http://purl.org/dc/elements/1.1/PDF link annotation
    • http://ns.adobe.com/xap/1.0/PDF link annotation
    • http://ns.adobe.com/pdf/1.3/PDF link annotation
    • http://ns.adobe.com/xap/1.0/mm/PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XPDF link annotation
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZPDF link annotation
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TPDF link annotation
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0PDF link annotation
    • http://www.microsoft.com/typography/0PDF link annotation
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouPDF link annotation
    • http://www.microsoft.com/typography/fonts/default.aspxPDF link annotation
    • http://www.microsoft.com/typographyPDF link annotation
    • http://www.microsoft.com/typography/fonts/PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HPDF link annotation
    • http://www.microsoft.com/pki/certs/CSPCA.crt0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HPDF link annotation
    • http://www.microsoft.com/pki/certs/tspca.crt0PDF link annotation
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONPDF link annotation
    • http://www.monotype.com/html/type/license.htmlPDF link annotation
    • http://crl.verisign.com/ThawteTimestampingCA.crl0PDF link annotation
    • http://crl.verisign.com/tss-ca.crl0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0OPDF link annotation
    • http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0PDF link annotation

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off000330fa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x330FA 150720 bytes
SHA-256: 78c45aba9f2c0738f64f5b7f27015fb14a5a4f98e02bc71d8c5c0237a8092393
font_00_sfnt_off0000c665.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC665 168972 bytes
SHA-256: a70da2d370d9d343c32c3acfb46338fe25505f6614fdafb35e4830cc532d7855
font_01_sfnt_off0001f4d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F4D8 170232 bytes
SHA-256: e47944c18cb5580b94dee21b2f8c2357d6adb7872cba6322251ce8be6997293b
font_03_sfnt_off0003e051.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E051 45088 bytes
SHA-256: fadfe704508082b3bcf4ca9ec81c7f324abac476029526a6f179f90c502e6cb5
font_04_sfnt_off00041093.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41093 214576 bytes
SHA-256: 7a8f7a4141be010030582e45f622fe776ad985263a6fc0d90f9fb34a56dade99
font_05_sfnt_off00051e81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51E81 24332 bytes
SHA-256: ca6c494bb5ef9be7361cfad38425c9e5ec46bc51a29f0a9ed3e0b4866540a7f4
font_06_sfnt_off00055089.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55089 197920 bytes
SHA-256: 5b3318a8943d734a28ac03ceacf606c458a86f547ab718198117a4376279075a
font_07_sfnt_off0006a09b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A09B 41354 bytes
SHA-256: 31b6818c863421902b8cce6eaf4e32c51aca9aacf33e8c1dfaca5430edbe0e04
font_08_sfnt_off000713e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x713E5 36784 bytes
SHA-256: 4a28d8add73cdf72a6dac19969b34bba655b6479d009fe0cc449365c0b4cd880

Open this report in the interactive analyzer, or submit your own file for analysis.