PDF / .VIR static analysis report

Static analysis result for SHA-256 e67904981d4c1afc…

CLEAN

PDF / .VIR

415.3 KB Created: 2023-12-25 20:40:50 +03:00 Authoring application: Microsoft® Word 2016 First seen: 2024-06-26
MD5: 35c316c318f143ff9dd28f69d21572e6 SHA-1: 50ff8127f39b385c4004aa23f90065309c3b3d49 SHA-256: e67904981d4c1afc2761d8b1d45e540f66575068853a561b69ba1b0e8ccf2d4f
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0038

Heuristics 2

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoft In extracted file (font_00_sfnt_off0000f183.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000f183.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_00_sfnt_off0000f183.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_00_sfnt_off0000f183.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_00_sfnt_off0000f183.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_00_sfnt_off0000f183.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f183.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF183 537988 bytes
SHA-256: 1353513270a633226b001a320ec20b828b104c33ea5bc3ec65cde038632ac8c1
font_01_sfnt_off0003a0e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A0E3 94060 bytes
SHA-256: c54288d63f562197970d4cbc600f6d3d67813ebc761a896ba488b7d2282757a2
font_02_sfnt_off0003ce7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CE7B 350336 bytes
SHA-256: fb15568ec11e48fd67b2f3d148693ff5e50920a6446df8c611c54eee2af24348
font_03_sfnt_off0004f93d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F93D 380064 bytes
SHA-256: 1d5e74a8d31495af3fa56ed5c26067770954992310fd415fd8ee8eb915fe35e9

Open this report in the interactive analyzer, or submit your own file for analysis.