PDF / .VIR static analysis report

Static analysis result for SHA-256 e1dd9b2f4731c85e…

SUSPICIOUS

PDF / .VIR

441.1 KB Created: 2023-11-06 06:49:41 Authoring application: Karbon First seen: 2024-09-28
MD5: 2d78b851b15d8805ef0425dd5b214a91 SHA-1: 6fd0fc519f332ea385a1397cb312341f3cb071c5 SHA-256: e1dd9b2f4731c85edf8c63926f189a5b375b392e1938f79eefb43a198efed13c
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6383

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://clan-of-the-cave-bear-free-epub.brittanygroundhouse.com/55579647459.pdf PDF link annotation
    • https://2008-gmc-yukon-operations-manual.akgrafik.com/6250794677.pdfIn PDF document text
    • https://book-about-creepy-children.workforceok.org/52432151087.pdfIn PDF document text
    • https://la-soumise-le-collier-tome-5-epub-gratuit-pdf.classiccountry1390.com/zewobopusowimikitezojevez.pdfIn PDF document text
    • https://drugs-book-pdf-free.brookelyn.org/falupifazunowi.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/30618d60-0cef-4385-b792-800849c38b12/downloads/76413584694.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4495e0bd-5ab2-4004-8be1-e30ef3373564/downloads/how_to_repair_little_tikes_bounce_house.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/e3743f65-6875-49ef-87db-9c97db9bcff8/downloads/tulozirigulirabasi.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4d02ebb2-e6cb-4939-adfe-e191eb1694dc/downloads/vopeguzasofikazoz.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4d02ebb2-e6cb-4939-adfe-e191eb1694dc/downloads/dapumorapozuwawizasif.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/d5e97205-d745-471d-94c2-4bc94f943a29/downloads/37424660690.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00068e88.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00068e88.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00068e88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68E88 18444 bytes
SHA-256: b9f839e430a624cbed2b5afd919e855f28174397b89378888c9950d05c9b30ad
font_01_sfnt_off0006bc29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BC29 10956 bytes
SHA-256: 7bfaf4038fbe5c3c36f13f06c4ed80540b27c0c2dcb9c4fb852345162e4cc038

Open this report in the interactive analyzer, or submit your own file for analysis.