PDF / .VIR static analysis report

Static analysis result for SHA-256 db33f76907df79cb…

SUSPICIOUS

PDF / .VIR

280.8 KB Created: 2018-03-14 16:21:16 -07:00 First seen: 2024-04-14
MD5: 0ab12c6ab493eb4df179264ed6798ad6 SHA-1: 2a4836a11603c4d196c9f7d9da8ec7fc402df4b1 SHA-256: db33f76907df79cbe685e00ac93c13879e5a2a5b5099dc77c67a3f6477034d3e
30 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0031

Heuristics 6

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.typography.comSemiBold/FSType In extracted file (font_14_cff_off0001cad7.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.aiim.org/pdfua/ns/id/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://www.typography.com/FSTypeIn extracted file (font_12_cff_off0001b159.bin)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 21

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00000cce.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCCE 54066 bytes
SHA-256: 8c0cc5057fb51a8ed1dc8c0bbeadae62ea55a756a3b5187432f5ff453b016a64
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
stream_019_off00006ba1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6BA1 55856 bytes
SHA-256: 6ab2c8fb2a8cae700fa756ca2f152c2925dcdc83282692e5a05d23adf1f82384
stream_030_off0000e156.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE156 61176 bytes
SHA-256: 5bf396bc190d077e2f7cabc80eac10622c8971fa7006124d6822f6581f8b21fd
stream_104_off00032d92.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32D92 68129 bytes
SHA-256: 32cb47f30f01242e04c1bcc951f941e9c4dc10473d2af8b9ec5e5ee0dcd01673
objstm_0041_00.bin pdf-objstm-decoded PDF /ObjStm 41 0 obj (inflated) 10357 bytes
SHA-256: c91685eb24f049a429da5212af60049bc0dbc862de127265650e764743f3a728
objstm_0042_00.bin pdf-objstm-decoded PDF /ObjStm 42 0 obj (inflated) 5529 bytes
SHA-256: 71ee421fb4a1f4b7e7acec6ef7d5c33944d433d1ec651bd94db9774c9f2aac60
font_00_cff_off00005f73.bin pdf-font-stream PDF embedded font (cff) at offset 0x5F73 1851 bytes
SHA-256: 8f6dda0b2c0b271bfe636f388c5952e8a94cc2122624f2638db609e5038be541
font_02_sfnt_off0000bd03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD03 7336 bytes
SHA-256: 4c289c2e4ebd09f366ec5cb663ce01b6b1249d1c2354f5d8ccf7ebdb5502fd49
font_03_sfnt_off0000d27e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD27E 4684 bytes
SHA-256: cd3fc5a21f91ddc3bf72326d0933ea334e337fc5cca30080e3a9ecb78de97e06
font_05_cff_off000144e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x144E2 4488 bytes
SHA-256: 1a9d3cd813579e0a6991567d540837f250c35cc4027f64485d5b4388d05af59a
font_06_cff_off00015664.bin pdf-font-stream PDF embedded font (cff) at offset 0x15664 2964 bytes
SHA-256: 8fc875f3e5541320d3438df90f9db50e6fd7a87b7ec8704aff703603586f7e71
font_07_cff_off00016335.bin pdf-font-stream PDF embedded font (cff) at offset 0x16335 3713 bytes
SHA-256: 28ca956396e1fe098a9c01383e934c2b5d929a867e1a8483d9716fe3eb79dd62
font_08_cff_off0001722b.bin pdf-font-stream PDF embedded font (cff) at offset 0x1722B 2652 bytes
SHA-256: b06e06266be6c9add255a7e73613617e8c51c82dfa6e251391aa3f8ef3391c2d
font_09_cff_off00017f65.bin pdf-font-stream PDF embedded font (cff) at offset 0x17F65 412 bytes
SHA-256: 65300f9f12190b84d16b7ac7cc864f6b83a314ca788683977ee7cb860179196a
font_10_cff_off000182e2.bin pdf-font-stream PDF embedded font (cff) at offset 0x182E2 2964 bytes
SHA-256: ba9e046fde196db6331fac297502748e1fc7a64607451fa5502e0097052f45d9
font_11_cff_off00018f3d.bin pdf-font-stream PDF embedded font (cff) at offset 0x18F3D 3713 bytes
SHA-256: 2589057085cb32ff41f3fbf1e8bcf03f565db7b21383ee2fbe30104af5a7a85c
font_12_cff_off0001b159.bin pdf-font-stream PDF embedded font (cff) at offset 0x1B159 1489 bytes
SHA-256: 05d4d1d4fcf1aaa5f4d98cb8990e38baa175be0dc0035cbd29af67b156a44854
font_13_cff_off0001b8d6.bin pdf-font-stream PDF embedded font (cff) at offset 0x1B8D6 4531 bytes
SHA-256: 0f3b9da70ba638ec2094e2256dfda0daf419e55130753ff48a66f4aeabc8eb9d
font_14_cff_off0001cad7.bin pdf-font-stream PDF embedded font (cff) at offset 0x1CAD7 2268 bytes
SHA-256: ff135edc6f55f6262bbc3f61ff23038c706be9e67f288a4e7cb35eed725d715e
font_15_sfnt_off0002943a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2943A 45215 bytes
SHA-256: d21692a0746a14d620ee28272b2140f458200af7122bdca3c031780e96b5f633
font_17_sfnt_off00041af8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41AF8 50988 bytes
SHA-256: 97dc274aa413df101cce2b4bed496bdeaf7a3720c86ba52f862e25c20ddbe59e

Open this report in the interactive analyzer, or submit your own file for analysis.