PDF / .VIR static analysis report

Static analysis result for SHA-256 e61c6ba7a4ae22a1…

CLEAN

PDF / .VIR

169.9 KB Created: 2025-10-07 13:05:08 -03:00 Authoring application: Microsoft® Word para Microsoft 365 First seen: 2025-12-03
MD5: 736b0c2c927680108315105a00c6603e SHA-1: 00568cf2939c315170fd9644d5f906dae9a2a0f7 SHA-256: e61c6ba7a4ae22a121c80092c0113b8c6c77b6280b699c5a644f0b133fdb9a00
2 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md In extracted file (font_00_sfnt_off0001997c.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/aboutWeightWidthOpticalIn extracted file (font_00_sfnt_off0001997c.bin)
    • https://docs.microsoft.com/typography/aboutWeightWidthRegularOpticalIn extracted file (font_01_sfnt_off0001d692.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_02_sfnt_off00020716.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_02_sfnt_off00020716.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_02_sfnt_off00020716.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_02_sfnt_off00020716.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_02_sfnt_off00020716.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlMicrosoftIn extracted file (font_04_sfnt_off000274b2.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_04_sfnt_off000274b2.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off0000c36e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC36E 95018 bytes
SHA-256: 6608a49558eb1a036701a25cfb7834b458611dc3080f3c075d0274452f13e8b8
stream_008_off0000ecd0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xECD0 95557 bytes
SHA-256: a082f76e8263ed7ea32a886ed1ba926c14aa3970e89e859381f101b4b91ee012
stream_010_off00011483.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11483 95095 bytes
SHA-256: 004fdb39a47dd51f50dbdd14704cf2f1a69034036a1f242282d717333c45613c
stream_012_off00014d54.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14D54 82313 bytes
SHA-256: a29c71cb68c1b515e005ed53e19b19f73e0f1298f116405b37dad285bac20e70
font_00_sfnt_off0001997c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1997C 30116 bytes
SHA-256: ca8bbdc48ea53de278a84af47eec8144ff8563eb974ebb57fc56aecb3f9f95e1
font_01_sfnt_off0001d692.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D692 26360 bytes
SHA-256: e7d751d81d5df84e84845ff7ac5b563735d86debc9e15bf05adc0d4f5eecaeb4
font_02_sfnt_off00020716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20716 58484 bytes
SHA-256: 580f5aa800544b598e242c565c7e5003f45ecbd4e2b6f7123ea9969cdc25b5ae
font_03_sfnt_off00025008.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25008 22228 bytes
SHA-256: 1a713f99f34226a7bbe84e4b585a97aea21b5f4f6be54d13a91eec14cbe4d411
font_04_sfnt_off000274b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x274B2 11088 bytes
SHA-256: 086b4c456dbe6f09f8c99517bcda6cd0f82646bc0cf77bf0a1e64dd9a7c38fd3

Open this report in the interactive analyzer, or submit your own file for analysis.