PDF / .VIR static analysis report

Static analysis result for SHA-256 e2cf1e0d5d51fc55…

SUSPICIOUS

PDF / .VIR

116.5 KB Created: 2023-03-22 19:42:08 Authoring application: SWFTools First seen: 2024-09-20
MD5: 2144c7e6d3eef599ca724757b077caba SHA-1: f2eec32ccddbcfcb2f4e2beee0fcadd3efbcba25 SHA-256: e2cf1e0d5d51fc55b58fcaf7783067e8f27846589362ed28d4fe9a8bb4e9a3fc
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7071

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://adservice.google.com.pr/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/3e7e40b7-83a3-42d4-bb83-ebda1a02aafe/downloads/57987751930.pdf In PDF document text
    • https://adservice.google.co.ve/ddm/clk/408533097;208818505;l;;%3F//img1.wsimg.com/blobby/go/3d8c405e-d09a-43e6-b2b9-f8bbfe0e4b05/downloads/37091120154.pdfIn PDF document text
    • https://adservice.google.pn/ddm/clk/425484003;227454619;f;;%3F//img1.wsimg.com/blobby/go/a69dd3f6-1a69-42b6-80f6-5f683ef0decf/downloads/melozuteboparawaxokuvi.pdfPDF link annotation
    • https://img1.wsimg.com/blobby/go/3e7e40b7-83a3-42d4-bb83-ebda1a02aafe/downloads/puxumikoxegasivos.pdfIn PDF document text
    • https://adservice.google.tn/ddm/clk/466651624;272226156;i;;%3F//img1.wsimg.com/blobby/go/7ec83fbc-4f18-40ca-a246-7181d9026215/downloads/72017253156.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0001807e.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0001807e.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001807e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1807E 16164 bytes
SHA-256: 1ff8353542f6810d80e7ee70006d35ce7255ec23dc28ab47021143f63f69ce9a
font_01_sfnt_off0001aa25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AA25 11952 bytes
SHA-256: d302e7fcb9d46f5a74fdf7a244a40b7426e2d261d8af9f979287e15e69df55fd

Open this report in the interactive analyzer, or submit your own file for analysis.