CLEAN
4
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0001
Heuristics 2
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://wwww.microsoft.com0 In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
- http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn PDF document text
- http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In PDF document text
- http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn PDF document text
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In PDF document text
- http://www.microsoft.com/PKI/docs/CPS/default.htm0@In PDF document text
- http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn PDF document text
- http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In PDF document text
- http://www.microsoft.com/pkiops/Docs/Repository.htm0In PDF document text
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In PDF document text
- https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn PDF document text
- http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn PDF document text
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In PDF document text
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_090_off0012687e.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x12687E | 12100 bytes |
SHA-256: 0bd17ee6204f7335c7bf86d88026293eb0ad0a4579df80ba7e3966c554bd8f15 |
|||
stream_092_off00127357.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x127357 | 12100 bytes |
SHA-256: 0f8a681d3b8c0b0f15e4530efb2eaebd73e9da7c74cc942047faf07c2fa6b6a8 |
|||
stream_130_off001d2981.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1D2981 | 44108 bytes |
SHA-256: 38ac4aea6916bd134e545760fcc23dc7981178fdb8c2ce727e2809c7748a70c4 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
stream_132_off001d4e6c.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1D4E6C | 114960 bytes |
SHA-256: 1731db079aabbcf0d301879f378efa34ce60908f13dbcc186a4cb9f233bb44a5 |
|||
stream_137_off001f6ddb.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x1F6DDB | 99576 bytes |
SHA-256: e91779a10a18315dc0d279ebf6a456bd84aa6b644c63c70daccdd06c939bd399 |
|||
font_01_sfnt_off001e294c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E294C | 95768 bytes |
SHA-256: d6726790f62ae0294bb8f4b3fcc00e4d50a3b2904e226ce7e5f21a9236c75b82 |
|||
font_02_sfnt_off001edf62.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1EDF62 | 76772 bytes |
SHA-256: 42b5f4e57b519d227936119510f6591bf6a8d69dc0757cfc9b0c982d05550a5f |
|||
font_04_sfnt_off001fed34.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1FED34 | 73488 bytes |
SHA-256: 8d039c6316ac9e9ad5dd983307bd6d9e572edae8aec972ea2862d4f9f4199e9c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.