PDF / .VIR static analysis report

Static analysis result for SHA-256 f2361d06d7831df6…

CLEAN

PDF / .VIR

7.60 MB First seen: 2026-06-02
MD5: 2b900f6f1f728e1902050edaa93b61fd SHA-1: d7ba777204bb3b369dae9c489b32bbe25577b0f5 SHA-256: f2361d06d7831df60b263f85bdfe22ac42ba65cb71823237680189c5772876f5
20 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains heuristics indicating a potential invoice or payment lure, combined with a PDF launch action that points to a local document path. While the URLs extracted are confirmed benign, the presence of invoice language and the launch action suggest a social engineering attempt to trick the user into interacting with a file, possibly for malicious purposes. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0090

Heuristics 4

  • Launch action low PDF_LAUNCH
    PDF contains a /Launch action whose filespec target is a local document-management temp path; report for analyst visibility, but do not treat as command execution by itself
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.imf.org PDF link annotation
    • http://www.imf.org/external/country/hrv/index.htmIn PDF document text
    • https://www.worldbank.org/en/country/croatiaIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.imf.org/PDF link annotation
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_117_off00776086.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (stream_117_off00776086.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (stream_117_off00776086.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (stream_117_off00776086.bin)
    • http://www.microsoft.com/TypographyIn extracted file (stream_117_off00776086.bin)
    • https://openknowledge.worldbank.org/entities/publication/53662776-51a9-51dd-b674-c67350073515In extracted file (objstm_5978_00.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlMicrosoftIn extracted file (font_13_sfnt_off0075a3fe.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_13_sfnt_off0075a3fe.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 22

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_088_off0003f4be.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3F4BE 1005720 bytes
SHA-256: 9e9515e102f0226ac58f9e4164ae62e638742495704c5eaa54b22153b4759f4a
stream_114_off00768ec4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x768EC4 34404 bytes
SHA-256: 42cf6884295799dbcf8dc343e3f7e80dbe491411402e7c7b6d3458a81c8bfdd1
stream_116_off0076ef8f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x76EF8F 71560 bytes
SHA-256: 841a0445eba456f933c581724c51e3ad285d228f1254b23310979cf85ec10033
stream_117_off00776086.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x776086 106824 bytes
SHA-256: b87af7a37e04b7af8c0be3cc3d205c3579667bd02bd91979093a1d1d7c5fd9ce
objstm_5978_00.bin pdf-objstm-decoded PDF /ObjStm 5978 0 obj (inflated) 6678 bytes
SHA-256: 02090faa3d19c650a528ddf38e926f380e3ae1cef5b0894877cc42a78227e5ec
font_00_sfnt_off006f4e79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F4E79 75328 bytes
SHA-256: d1c4668d8f2baa306886d3540b4310920483717cef0a6b09ce695601a35e4f7c
font_01_sfnt_off0070c607.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70C607 89740 bytes
SHA-256: da306ac8cdd1f03f156845000770ffbc47930f962eaadc100c377a86aaa5f29a
font_02_sfnt_off00716f42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x716F42 67808 bytes
SHA-256: 5ab84ebfce94db439575671fbbc6ed027e83f27007e1dfa8c0dadf96b8bf0a20
font_03_sfnt_off0071e867.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71E867 77480 bytes
SHA-256: ff869068892d11d0d3fe5b1857fe6072057e5490ca43eed16e742edc080b1a17
font_04_sfnt_off007269f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7269F5 47780 bytes
SHA-256: 547f6b84317d8992a14c29c6e81e8e2a84e8711059db1824ff8cda6c4787b6bd
font_05_sfnt_off0072c37f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72C37F 66752 bytes
SHA-256: cbb97ac0cbd38cf64cee19880590282f2bd7f116da3a20800e3253ac6771460e
font_06_sfnt_off00732b4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x732B4F 43688 bytes
SHA-256: 9329a95dd36b8589c98ad74297e71e8b9d3181d36233a567b3d3c013db451d21
font_07_sfnt_off0073b55e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73B55E 5911 bytes
SHA-256: a1fcd94688b6cb0e51d0d097021ff9031050a29d92336c3d694d567f484477ff
font_08_sfnt_off0073c7e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73C7E4 79784 bytes
SHA-256: 55049ef96c24fd236f1652c6381dd592e62fe51774b5c627562d62b87adf3d93
font_09_sfnt_off007429c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7429C1 61206 bytes
SHA-256: 32c9a36b1cebd34a483971f3404341deb95fe01095476b12ae72cf2a494f8f93
font_10_sfnt_off00747ede.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x747EDE 56608 bytes
SHA-256: 7697426c627dfe58fbdd1c4305ad3a641a8824c7be884b218d5876629d16d577
font_11_sfnt_off0074fd71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x74FD71 76972 bytes
SHA-256: 1fc5ec8814702f24d0a7c61c4df0a42edd9a88bdc3cfc57def7c057f9915edb3
font_12_sfnt_off00755d93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x755D93 65948 bytes
SHA-256: a72f2df81d342457ade109599d259b8c154990360e32a231a910a956d4edc6b0
font_13_sfnt_off0075a3fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75A3FE 11088 bytes
SHA-256: 086b4c456dbe6f09f8c99517bcda6cd0f82646bc0cf77bf0a1e64dd9a7c38fd3
font_14_sfnt_off007627a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7627A6 80720 bytes
SHA-256: 089fba48698fa0d57c9ecc9ffaf576a3aecc0726fc94fb20ccd6e360b8cbe8e9
font_16_sfnt_off0076b819.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76B819 38564 bytes
SHA-256: 64f7a4c0e0ab4491747094d1d686ece973648106b2e75415803fd75ba1f7032d
font_19_sfnt_off0079146e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79146E 77048 bytes
SHA-256: f524e17ff5596b4cffb7537fb73a4f7dbde8c8750d241018ac3a4eab9c405880

Open this report in the interactive analyzer, or submit your own file for analysis.