Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 e520fc30a39f115b…

MALICIOUS

PDF / .VIR

1.47 MB Created: 2012-02-27 09:08:07 +01:00 Authoring application: Microsoft® Word 2010 First seen: 2024-10-23
MD5: e4e2eb650ba91644fa81b4b7d3b7cb64 SHA-1: 89e0a60aec8dea68e0bca379d3d34374753eadfa SHA-256: e520fc30a39f115bb632be270a7292bc47d00013bb9c1849e56a8dae95e64403
72 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 4

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • PDF static-analysis soft budget exhausted low SCAN_INCOMPLETE
    The bounded PDF scanner skipped late sub-format walkers after the configured per-file soft deadline. Earlier findings remain valid.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ohchr.org/english/issues/housing/index.htm PDF link annotation
    • http://www.ohchr.org/english/issues/detention/index.htmIn PDF document text
    • http://www.ohchr.org/english/countries/kh/mandate/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/children/rapporteur/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/education/rapporteur/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/disappear/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/executions/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/food/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/opinion/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/religion/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/health/right/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/defenders/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/judiciary/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/indigenous/rapporteur/In PDF document text
    • http://www.ohchr.org/english/issues/mercenaries/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/migration/rapporteur/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/minorities/expert/index.htmIn PDF document text
    • http://www.ohchr.org/english/countries/ps/mandate/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/racism/rapporteur/index.htmIn PDF document text
    • http://www.ohchr.org/english/countries/sd/mandate/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/terrorism/rapporteur/srchr.htmIn PDF document text
    • http://www.ohchr.org/english/issues/torture/rapporteur/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/environment/waste/In PDF document text
    • http://www.ohchr.org/english/issues/trafficking/index.htmIn PDF document text
    • http://www.ohchr.org/english/issues/women/rapporteur/index.htmIn PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2011_02/AL_UNFICYP_17.02.2011.pdfIn PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Brazil_01.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/AL_Iraq_01.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Iraq_12.01.2011_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/AL_Jamaica_01.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Jamaica_31.01.2011_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Peru_01.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Colombie_02.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Colombia_24.02.11_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Mexique_03.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Russie_03.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Russia%2021.02.2011_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Ukraine_03.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Ukraine_21.02.2011_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Chine_07.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Georgie_07.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/AL_Ukraine_07.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Egypte_08.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Egypt_17.12.2010_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/UA_Italie_08.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Italia_10.12.2010_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Italia_06.01.2011_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/AL_Other_08.12.10_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Com/2010_12/AL_Chile_09.12.2010_In PDF document text
    • http://spcomms.ohchr.org/Docs/01ComRepSep2011/Rep/2010_12coms/PR_Chile_04.01.2011_In PDF document text
    +558 more URL(s)

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.