Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 e97ef78e38b67df4…

MALICIOUS

PDF / .VIR

448.0 KB Created: 2018-06-01 10:42:35 +02:00 Authoring application: Adobe InDesign CC 2017 (Macintosh) (via Adobe PDF Library 15.0) First seen: 2024-07-08
MD5: 6f0ae75c22643688f9773272e4724a6b SHA-1: 74a4ed0c7b01400d53c740130b4768a4f862d78d SHA-256: e97ef78e38b67df4c8cc7c2e4ea9fd742b75ac9f3ae0b8aad600f82998b28838
84 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://download.netjapan.eu In PDF document text
    • https://supportIn PDF document text
    • https://www.netjapan.eu/fileadmin/netjapan/Resources/Best_practices/Best-practices-imageboot-EN.pdfIn PDF document text
    • https://www.facebook.com/netjapan.emeaPDF link annotation
    • https://twitter.com/NetJapanEMEAIn PDF document text
    • https://www.linkedin.com/company/netjapan-emeaIn PDF document text
    • https://plus.google.com/+NetJapan_emeaIn PDF document text
    • https://www.youtube.com/c/Netjapan_emeaIn PDF document text
    • https://www.xing.com/companies/netjapangmbhIn PDF document text
    • http://technet.microsoft.com/en-us/sysinternals/bb897553In PDF document text
    • https://www.7-zip.orgIn PDF document text
    • https://www.microsoft.com/en-us/download/details.aspx?id=11896In PDF document text
    • https://www.microsoft.com/en-us/download/details.aspx?id=9386In PDF document text
    • https://support.microsoft.com/kb/2553708In PDF document text
    • https://support.microsoft.com/kb/2470478In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://www.iec.chIn PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: support 6 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off000053ad.icc pdf-icc-profile PDF ICC profile at offset 0x53AD 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00005e10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E10 13852 bytes
SHA-256: 7a342651647df85797c9cfba18dba3961b552eb56ac4984287722c02a0497d77
font_01_sfnt_off00007d2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D2C 18637 bytes
SHA-256: 49234f0a9c99795eb218531a4f6e03c3c9b9e359c4a001de3aa8af9516a902ba
font_02_sfnt_off0000a942.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA942 18069 bytes
SHA-256: 64b059fa38687cdc0a12469d6dc39c259beb8d1abb623aa3a96344a35b6cfe2d
font_03_sfnt_off0000d476.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD476 16494 bytes
SHA-256: 7627137975b65d07a2a215ec240c3c0e37b51b59b6f26e94772681efe6d92dbb
font_04_sfnt_off0004d2a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D2A0 39046 bytes
SHA-256: cb431104ad955fe937643fdf37cbbf5b4b1ea992eea2e8421ece8baee7c551be
font_05_sfnt_off00058724.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58724 18747 bytes
SHA-256: 71ab333f584188d4d165f77abde3cdd04918791ed3669241007589a2a4cb57e8
font_06_sfnt_off0005c0ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5C0AC 60328 bytes
SHA-256: b308fb56ef3de21887c6194711f7bd94d837026a119defe5572a516b743de08e
font_07_sfnt_off00063fd4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63FD4 37902 bytes
SHA-256: 9192ebcc4905bb213c838ad6be3a154e02cc452520db74a18e30cd8f35ac885c
font_08_sfnt_off00068391.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68391 7716 bytes
SHA-256: a22edb6ffd506b6ca34fac80c7f7d610189a2c2c79a4e9835f8d33edd6338a66
font_09_sfnt_off000699ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x699CE 12221 bytes
SHA-256: fc1fdc75a3b2693485b1336ea74f220da99f6fefb494e5bd42cbe99baf4f1804

Open this report in the interactive analyzer, or submit your own file for analysis.