PDF / .VIR static analysis report

Static analysis result for SHA-256 d57787268321ae28…

CLEAN

PDF / .VIR

145.6 KB First seen: 2024-07-02
MD5: b1fc42ff9c0df181e66051379624dd42 SHA-1: 56f4e1af938370e278a8abddd9d2447f5e59cad0 SHA-256: d57787268321ae28fe3cd4032e6774b4f5846f1e70dacda06cb617741166231e
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • https://en.wikipedia.org/wiki/Matrix_decompositionPDF link annotation
    • https://twitter.com/WomenInStat/status/1285610321747611653In extracted file (objstm_0001_00.bin)
    • https://stats.stackexchange.com/a/134283/26909In extracted file (objstm_0001_00.bin)
    • https://en.wikipedia.org/wiki/Singular_value_decompositionIn extracted file (objstm_0001_00.bin)
    • http://bryanhanson.github.io/LearnPCA/articles/Vig_01_Start_Here.html#works-consultedIn extracted file (objstm_0001_00.bin)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 29

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_015_off000133fc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x133FC 2290 bytes
SHA-256: ec15c6c9de75130ea4d2e8a7cb729c981ed9f9cf17b1c24d0be11718ed0f9f73
objstm_0001_00.bin pdf-objstm-decoded PDF /ObjStm 1 0 obj (inflated) 22868 bytes
SHA-256: 6622517557826d531dfbe1f51d07cd361089c4fa3d190b1651205a70ede3b040
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 long base64-like blob(s).
font_00_cff_off000092cb.bin pdf-font-stream PDF embedded font (cff) at offset 0x92CB 8465 bytes
SHA-256: 077bc26ffd6cacdc48420bbeb24870613d6968f7dd7115e23109072ca9d08d34
font_01_cff_off0000ad58.bin pdf-font-stream PDF embedded font (cff) at offset 0xAD58 6367 bytes
SHA-256: 447f682977a13efb493c446880a1258845b8c639661a1f694cf4d5ee2135e11c
font_02_cff_off0000c200.bin pdf-font-stream PDF embedded font (cff) at offset 0xC200 6851 bytes
SHA-256: e67b86d6c1f70d5c18e61a67286c3775f09ef073ea25a50073cf90e70df3db1e
font_03_cff_off0000d82a.bin pdf-font-stream PDF embedded font (cff) at offset 0xD82A 10144 bytes
SHA-256: 650dab3b71625043221529d680850c2871abb1f351771f35beebbfe33d627ddd
font_04_cff_off0000f6ba.bin pdf-font-stream PDF embedded font (cff) at offset 0xF6BA 6410 bytes
SHA-256: d5ec26794f237c54e2ea6e3b42502b172f74cc74f945fa5955377455f8636893
font_05_cff_off0001096c.bin pdf-font-stream PDF embedded font (cff) at offset 0x1096C 6103 bytes
SHA-256: 776d5328ce2d2ee49c6325f54948d8fd20777e690db81cae57fb2437f1245bfc
font_06_cff_off00011d02.bin pdf-font-stream PDF embedded font (cff) at offset 0x11D02 7752 bytes
SHA-256: 33476bd176da4dede6359cbec0843fec10a33824e2226eb9093e23596ffbd3bd
font_08_cff_off00013bd1.bin pdf-font-stream PDF embedded font (cff) at offset 0x13BD1 1343 bytes
SHA-256: c950372f1569ce2124826f72a91aa76ac6da1bdc0c322017fd1600f909714405
font_09_cff_off000140fb.bin pdf-font-stream PDF embedded font (cff) at offset 0x140FB 195 bytes
SHA-256: d61e2469557e464a690fe2ac204dbebe7d53f27b697f7da2b72a06126d9ac81e
font_10_cff_off00014223.bin pdf-font-stream PDF embedded font (cff) at offset 0x14223 988 bytes
SHA-256: f41f3a569a3a687dbdd01349c96642cc4692191b334965da7ecc9feb305a46d9
font_11_cff_off0001462d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1462D 1633 bytes
SHA-256: 0db7d7a282edea0096cbf10ac69abc05fdf977cb18244cbe433ccf326aa4ba7e
font_12_cff_off00014c7b.bin pdf-font-stream PDF embedded font (cff) at offset 0x14C7B 224 bytes
SHA-256: d12ef341e4dcc70c8c36bb3d3334b7dc8669f4b17091db577351ac9c17f5e0a9
font_13_cff_off00014db9.bin pdf-font-stream PDF embedded font (cff) at offset 0x14DB9 466 bytes
SHA-256: 79a162d45dc05a1ebd76f4441b926b0b76d096c538ab05f5fca9eb2a97f36ad6
font_14_cff_off00014fdd.bin pdf-font-stream PDF embedded font (cff) at offset 0x14FDD 1468 bytes
SHA-256: 1bf36b6cc6e5bed0334a6716ba60befda028aa24639080f46b9b8a31f2ae9c75
font_15_cff_off000155a4.bin pdf-font-stream PDF embedded font (cff) at offset 0x155A4 4584 bytes
SHA-256: 7ebd972588eca0f6687172ae2108fbfd22be7fa86e3554eabd726eeadd424ab7
font_16_cff_off00016490.bin pdf-font-stream PDF embedded font (cff) at offset 0x16490 1781 bytes
SHA-256: 48fff173bae7302226cabfd2742a376af378b9b139b2c6fb3df351c6d952249d
font_17_cff_off00016b13.bin pdf-font-stream PDF embedded font (cff) at offset 0x16B13 304 bytes
SHA-256: a4b1693098c6b6a5c473a0f626f4e7227020599959d1e0516720300b2dfcbf83
font_18_cff_off00016ca6.bin pdf-font-stream PDF embedded font (cff) at offset 0x16CA6 381 bytes
SHA-256: 177e67aa474159bf564ab6ea8839b439d41bb0aa60361f443fe8cf2329577f56
font_19_cff_off00016e74.bin pdf-font-stream PDF embedded font (cff) at offset 0x16E74 853 bytes
SHA-256: b00c10e2cca922b0fd988b1331879191d77c1f652e288301cbe9a540b4fa0879
font_20_cff_off000171ef.bin pdf-font-stream PDF embedded font (cff) at offset 0x171EF 309 bytes
SHA-256: b6deeccfd3e726397f3ee76a089423ba2ea55d83a860d64d4b8db7c44172f4a6
font_21_cff_off00017387.bin pdf-font-stream PDF embedded font (cff) at offset 0x17387 395 bytes
SHA-256: 94b1decfa00b5f0da409e6c3e49fbd2fa23403a8eec69b081cf119295a70a363
font_22_cff_off0001756d.bin pdf-font-stream PDF embedded font (cff) at offset 0x1756D 155 bytes
SHA-256: cf6bdc0efabf48c7fa3c865946a25e47afc04c839d9889d0e1625506253b30d5
font_23_cff_off0001abe6.bin pdf-font-stream PDF embedded font (cff) at offset 0x1ABE6 1763 bytes
SHA-256: 44ab7d1c7f6d646ae804abe67ecbafa57ef52114fe3690476cfd3e98c0707260
font_24_cff_off0001b228.bin pdf-font-stream PDF embedded font (cff) at offset 0x1B228 2738 bytes
SHA-256: 02deaa2e6b913bf586383d2e2d33a561c37df58a775c23eb32ebe15795f06d65
font_25_cff_off0001bbde.bin pdf-font-stream PDF embedded font (cff) at offset 0x1BBDE 494 bytes
SHA-256: dbf430d8cb8f427907698306b0c46d90f093d8e9634884787f42942e7283a339
font_26_cff_off00021454.bin pdf-font-stream PDF embedded font (cff) at offset 0x21454 1217 bytes
SHA-256: 39ac87852d4c6c7240780e004f3cc701daed141803dcecca9efd8970c688b019
font_27_cff_off0002347b.bin pdf-font-stream PDF embedded font (cff) at offset 0x2347B 204 bytes
SHA-256: 4fb9fc01cc601eef6a23f9396cead7af6eb8887c5662860b269e40795a697a0e

Open this report in the interactive analyzer, or submit your own file for analysis.