Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 e432769808d500a8…

MALICIOUS

PDF / .VIR

339.3 KB Created: 2023-06-12 04:53:29 Authoring application: ImageMagick First seen: 2024-09-20
MD5: dbb3223d9dca0b8a1ae09988fc55473a SHA-1: 31604eb4d6536310b7f658bffdc28f9abc61c7b2 SHA-256: e432769808d500a8d08182bc16672762bcca3cd8569ae1f654f8ab9f137ea854
76 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7512

Heuristics 4

  • QR business-process phishing lure high SE_QR_BUSINESS_PROCESS_LURE
    Document asks the recipient to scan a QR code in an HR, payroll, compensation, employee-handbook, DocuSign, or business-signature workflow. This is a high-signal quishing/social-engineering pattern even when the QR payload cannot be decoded statically.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://2009-kubota-500-4x4-book-value.marieschefssoap.com/fakasoku.pdf PDF link annotation
    • https://2006-kia-sedona-blue-book-value.freshfabrication.com/mabek.pdfIn PDF document text
    • https://the-fourth-world-book.brittanygroundhouse.com/58954349268.pdfIn PDF document text
    • https://livre-recette-kenwood-cooking-chef-pdf.kmcgphoto.com/vomuxidilawenir.pdfIn PDF document text
    • https://2002-isuzu-rodeo-owners-manual-pdf.ocetoneri.com/67011055103.pdfIn PDF document text
    • https://griffiths-electrodynamics-3rd-edition-solution-manual-pdf.peykweb.com/kekidovexapate.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/06c67147-220c-4bce-8a38-331ac0b2841c/downloads/vufuxiriwezo.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/a6f72272-33fd-411c-bcf3-a41ce870240d/downloads/63925951057.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/a6f72272-33fd-411c-bcf3-a41ce870240d/downloads/dumexufulososulovunidu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004f8c2.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004f8c2.bin)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004f8c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F8C2 16344 bytes
SHA-256: 86e9ec4e1ea466763d75564132660f54b9f0e2cd1bae1f9101a2a14f77b74bc9
font_01_sfnt_off000522d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x522D6 12144 bytes
SHA-256: 5005cd7d0f23cffeba9eb9abd3db7aed8f7d98f4d3934bc7afffd96878d68af3

Open this report in the interactive analyzer, or submit your own file for analysis.