Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 e778e899f95583a3…

MALICIOUS

PDF / .VIR

890.6 KB Created: 2020-08-03 08:40:53 -04:00 Authoring application: Microsoft® Word para Microsoft 365 First seen: 2024-04-14
MD5: 4550884e3dd0338e0de233b34cb493f3 SHA-1: 3f39118b773fe6302cac192ac9a6b60bde0a44fa SHA-256: e778e899f95583a3f4da15236e81abeebb43993f0d438d53f91b96052e0a9a29
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.saij.gob.ar/ PDF link annotation
    • https://www.subtel.gob.cl/wp-content/uploads/2018/07/Informe_Final_IX_Encuesta_Acceso_y_Usos_Internet_2017.pdfIn PDF document text
    • https://www.biblioteca.org.ar/libros/150717.pdfIn PDF document text
    • https://www.camara.cl/pley/pley_detalle.aspx?prmID=12550&prmBoletin=12022-04In PDF document text
    • http://www.fiscaliadechile.cl/Fiscalia/archivo?id=31695&pid=211&tid=1&d=1In PDF document text
    • https://www.senado.cl/appsenado/templates/tramitacion/index.php?boletin_ini=12192-25In PDF document text
    • https://www.camara.cl/legislacion/ProyectosDeLey/tramitacion.aspx?prmID=12715&prmBOLETIN=12192-25In PDF document text
    • https://www.derechosdigitales.org/11400/que-dice-el-llamado-decreto-espia/In PDF document text
    • http://www.icdt.cl/wp-content/uploads/2017/08/peticion-CGR-30agosto.pdfIn PDF document text
    • https://www.contraloria.cl/pdfbuscador/dictamenes/041188N17/htmlIn PDF document text
    • https://www.camara.cl/pdf.aspx?prmTIPO=DOCUMENTOCOMUNICACIONCUENTA&prmID=70045In PDF document text
    • https://oedi.es/ciberdelitos/In PDF document text
    • https://www.hcdn.gob.ar/proyectos/proyecto.jsp?exp=2714-D-In PDF document text
    • http://www.sic.gov.co/recursos_user/documentos/normatividad/Ley_1273_2009.pdfIn PDF document text
    • https://www.derechosdigitales.org/publicaciones/convenio-de-budapest-aplicacion-en-In PDF document text
    • http://leyes.senado.gov.co/proyectos/images/documentos/Textos%20Radicados/Ponencias/2019/gaceta_349.pdfIn PDF document text
    • https://www.hcdn.gob.ar/proyectos/proyecto.jsp?exp=2714-D-2017In PDF document text
    • https://www.derechosdigitales.org/tipo_publicacion/publicaciones/In PDF document text
    • http://www.sic.gov.co/recursos_user/documentos/normatividad/Ley_1273_2In PDF document text
    • https://www.derechosdigitales.org/publicaciones/convenio-de-budapest-In PDF document text
    • https://www.impo.com.uy/bases/codigo-proceso-penal-2017/19293-2014In PDF document text
    • https://wearesocial.com/blog/2019/01/digital-2019-global-internet-use-In PDF document text
    • https://www.unodc.org/documents/toc/factsheets/TOC12_fs_general_ES_HIRES.pdfIn PDF document text
    • http://bcn.cl/1nmu1In PDF document text
    • https://www.coe.int/en/web/cdpcIn PDF document text
    • https://rm.coe.int/16802fa403In PDF document text
    • http://www.sophos.com/en-In PDF document text
    • https://www.coe.int/es/web/about-us/our-In PDF document text
    • https://www.coe.int/en/web/conventions/full-listIn PDF document text
    • http://dx.doi.org/10.18042/cepc/redc.108.03In PDF document text
    • https://www.diarioconstitucional.cl/articulos/normas-In PDF document text
    • http://dx.doi.org/10.4067/S0718-52002012000100003In PDF document text
    • https://www.coe.int/en/web/conventions/full-In PDF document text
    • https://web.archive.org/web/20060209153034/http://www.usdoj.gov/criminal/cybercrime/COEFAQs.htm#QE1In PDF document text
    • https://www.websitebuilderexpert.com/blog/us-state-biggest-cyberbully/In PDF document text
    • https://rm.coe.int/mutual-legal-assistance-manual-eng/1680782927In PDF document text
    • https://www.elmundo.es/elmundo/2009/01/13/cultura/1231842140.htmlIn PDF document text
    • https://www.interpol.int/ar/content/download/5586/file/Summary_CYBER_Strategy_2017_01_SP%20LR.pdf?inLanguage=esIn PDF document text
    • https://www.bcn.cl/historiadelaley/nc/historia-de-la-ley/6527/In PDF document text
    • https://www.coe.int/en/web/conventions/full-list/-In PDF document text
    • https://www.boe.es/In PDF document text
    • https://www.boe.es/eli/es/l/2015/10/05/41In PDF document text
    • https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806cac22In PDF document text
    • https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/185/signatures?p_auth=I7GT616WIn PDF document text
    • http://bcn.cl/2b8s6In PDF document text
    • http://bcn.cl/21t2cIn PDF document text
    • http://bcn.cl/213ecIn PDF document text
    • https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContentIn PDF document text
    • https://rm.coe.int/mutual-legal-assistance-In PDF document text
    • https://www.boe.es/buscar/act.php?id=BOE-A-1882-6036In PDF document text
    +22 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_122_off00073fe1.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x73FE1 12639 bytes
SHA-256: e45ef3e031b0f2be31b8dc78e42a8fd9f4ffea97e431f21cbcc2f98cf04bff5c
stream_131_off0007d001.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7D001 140972 bytes
SHA-256: 2a1211d2e47d8b176f67be124e06a2262eae851af88ac6b9d1f6b3b93c7ab612
stream_133_off0008acb6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8ACB6 171964 bytes
SHA-256: 7df64c842f0eebefcb4f84c5ca824b2664ea5a4c822888a0bf574844a8544b4f
font_02_sfnt_off0009ccfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9CCFE 164644 bytes
SHA-256: 36dd1c3b3f8df42321ec709136cc3f9678c0cfb2d7fb4afbd671211ce2665e7b
font_03_sfnt_off000aeb82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAEB82 133788 bytes
SHA-256: 19efba26913bf354bf39ed208d30202a1bf28c29d1974c3857e23b8348f4e275
font_04_sfnt_off000bc117.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC117 126996 bytes
SHA-256: f0b085aac05dc699db80e8896c50f0c2f3d5605444d4794fec62b98ee7da90d9
font_05_sfnt_off000c8f95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC8F95 11088 bytes
SHA-256: 086b4c456dbe6f09f8c99517bcda6cd0f82646bc0cf77bf0a1e64dd9a7c38fd3
font_06_sfnt_off000ca99c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA99C 93500 bytes
SHA-256: 8998496bd3093b900e9c19a600f62021c1986fa0039de86f8bb6985cd7b1c5c1

Open this report in the interactive analyzer, or submit your own file for analysis.