PDF / .VIR static analysis report

Static analysis result for SHA-256 d30ec43128dd8b40…

SUSPICIOUS

PDF / .VIR

87.5 KB Created: 2021-12-09 21:29:57 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2024-05-20
MD5: abd1268ef40cc6857577175613d6da43 SHA-1: ddb26a41e6444e45a50973670c28e475231f3045 SHA-256: d30ec43128dd8b40e0b81bdfb3e8f780ea07e59d41a87cd2ba386d580328735c
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0244

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://static.s123-cdn-static-b.com/uploads/4660103/normal_61b0ac50e7c73.pdf In PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4661499/normal_61b0542924ea6.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4661447/normal_61b0c5d7bc7da.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4660294/normal_61b08aa3e5739.pdfIn PDF document text
    • http://getpdf.pw/book?res=weby&isbn=9780548954539&kwd=Tales%20Of%20The%20City%20Room%20PDF link annotation
    • http://getpdf.pw/book?res=weby&isbn=9780548954539&kwd=Tales%20Of%20The%20City%20Room%20(1898In PDF document text
    • https://img1.wsimg.com/blobby/go/7fa436d4-7413-47aa-8602-d87c5555b4a1/caramelo-810.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000fba1.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fba1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA1 21916 bytes
SHA-256: 2269ef329059301864b5ca4bfa7c02b4ef2035f49a6472830002e73f2d277281
font_01_sfnt_off00012e78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E78 20364 bytes
SHA-256: 059b008df53e31709b302e82cdd73d1d1e5ba3b12053e2930731ba864baf4c57

Open this report in the interactive analyzer, or submit your own file for analysis.