PDF / .VIR static analysis report

Static analysis result for SHA-256 d9e78d99f3a2ee4d…

CLEAN

PDF / .VIR

686.2 KB Created: 2014-07-29 16:53:22 +12:00 Authoring application: Adobe InDesign CC 2014 (Windows) (via Adobe PDF Library 11.0) First seen: 2024-05-12
MD5: 8ca54c3676dfbdf6bcfae2682f10d1a8 SHA-1: c0a1d3b7a00b403825ac0718b490d57a963bbe8a SHA-256: d9e78d99f3a2ee4dcc20b4b8fde94c04e2da0727dc727c42cdfffb3b87885435
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 3

  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/aux/In PDF document text
    • http://ns.adobe.com/camera-raw-settings/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://www.iec.chIn extracted file (icc_00_off00007bd6.icc)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00007bd6.icc pdf-icc-profile PDF ICC profile at offset 0x7BD6 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0000863b.bin pdf-font-stream PDF embedded font (cff) at offset 0x863B 5630 bytes
SHA-256: a9c6a5e07543b972c01ee3bf28daee5b0abf80b2e8d5e1ed1bb77757f54ccfd9
font_01_cff_off00009a8f.bin pdf-font-stream PDF embedded font (cff) at offset 0x9A8F 6980 bytes
SHA-256: fe31958a4e54b4c45b9f2417777af7d87c825013d72d3416908260573dd376c1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.46, consistent with packed or encrypted content.
font_02_cff_off0008ff02.bin pdf-font-stream PDF embedded font (cff) at offset 0x8FF02 3584 bytes
SHA-256: a8de63adf0506b7d5e0315130d8610e039cd38ff1798b8dfb0aeb688eb723eb0
font_03_cff_off00090e58.bin pdf-font-stream PDF embedded font (cff) at offset 0x90E58 1220 bytes
SHA-256: 9bb7bdf4c7ec52c46421127aebe4821264017bbe49380d23bb3b7a9b4df628f9
font_04_cff_off000a18d7.bin pdf-font-stream PDF embedded font (cff) at offset 0xA18D7 4149 bytes
SHA-256: 5814a9fda325fc9ed4556705a1658dc89c3d9440ca29c9e628923831b63f9f78
font_05_cff_off000ab41c.bin pdf-font-stream PDF embedded font (cff) at offset 0xAB41C 772 bytes
SHA-256: 3e1753f2d6aa348497f4c36977c3a7c6eae07bdf2d048b673e81392dfcadd979

Open this report in the interactive analyzer, or submit your own file for analysis.