PDF / .VIR static analysis report

Static analysis result for SHA-256 e7c012747504666f…

SUSPICIOUS

PDF / .VIR

417.7 KB Created: 2023-09-09 09:52:17 Authoring application: Serif PagePlus First seen: 2024-05-20
MD5: 530bc45bac5639f8390d224ed979e22d SHA-1: 635b5236a5f005d88e5f77e5d2c818e125c0ed95 SHA-256: e7c012747504666fd84d401a2d5fa5fc2b203c6fd77fb72fc73515bd6df15252
36 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9481

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://strategic-staffing-4th-edition-pdf-free.kamanana.com/88.pdf In PDF document text
    • https://wsj-tax-guide-2023.meliwap.cfd/178339.pdfIn PDF document text
    • https://adservice.google.com.cy/ddm/clk/448794861;252804937;a;;%3F//safunisofiw.rutoxum.cfd/1717791.pdfIn PDF document text
    • https://vaxojodivad.letopudo.online/geveboramumadivix.pdfIn PDF document text
    • https://vufinire.gogazeweg.cfd/3318380.pdfIn PDF document text
    • https://adservice.google.com.cu/ddm/clk/425484003;227454619;f;;%3F//physical-chemistry-atkins-10th-edition-i.gubakofan.cfd/gunaj.pdfIn PDF document text
    • https://adservice.google.co.ug/ddm/clk/424929466;226923624;r;;%3F//fitness-professional-s-handbook-7th-edit.comment-maigrir.info/12.pdfIn PDF document text
    • https://residential-breaker-box-study-guide-pdf.oldtimersclocks.com/7524180.pdfIn PDF document text
    • https://unit-4-study-guide-answers.beaute-a-porter.com/8723385.pdfIn PDF document text
    • https://porux.tourslombok.com/5124520.pdfIn PDF document text
    • https://adservice.google.com.bo/ddm/clk/426382440;228185261;d;;%3F//management-an-introduction-7th-edition-p.posedulet.cfd/23.pdfIn PDF document text
    • https://madison-to-salt-lake-city.gukipub.cfd/40.pdfIn PDF document text
    • https://sony-alpha-200-user-manual-pdf.slothoki96.com/kobalubumev.pdfIn PDF document text
    • https://destiny-2-pc-leveling-guide.mlgnbit.com/969.pdfIn PDF document text
    • https://bawawelo.whoreallywrotethebible.com/765705615.pdfIn PDF document text
    • https://gxd-1-0-28h-tubeless-ready.jeletosiku.sbs/mokodakinedapakaves.pdfIn PDF document text
    • https://adservice.google.ps/ddm/clk/425484003;227454619;f;;%3F//rivasu.jobawuwi.cfd/7060196.pdfIn PDF document text
    • https://adservice.google.iq/ddm/clk/408405163;208572896;n;;%3F//stama-5-axis-cnc-owners-manual-pdf-free.talamagux.sbs/315.pdfIn PDF document text
    • https://adservice.google.tg/ddm/clk/408533097;208818505;l;;%3F//gidewozogij.mesiwov.cfd/vujarugizejanuraj.pdfIn PDF document text
    • https://adservice.google.jo/ddm/clk/448794861;252804937;a;;%3F//tv-guide-huntington-wv.mesapego.sbs/93.pdfIn PDF document text
    • https://adservice.google.rw/ddm/clk/408533097;208818505;l;;%3F//1997-nissan-pathfinder-service-manual-pd.gupejaj.cfd/15.pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000648a2.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000648a2.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000648a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x648A2 18000 bytes
SHA-256: 9722fe0132dca782e05db01e3c31b937acbed94be6e9d04a879944740a668554