PDF / .VIR static analysis report

Static analysis result for SHA-256 f2c473f712571965…

SUSPICIOUS

PDF / .VIR

396.0 KB Created: 2023-11-06 20:10:08 Authoring application: PDFedit First seen: 2024-10-24
MD5: 2c6bc1749d8bfd12f836081761e2fe52 SHA-1: 27a056d5cf8fb716c5c43106aa06139ab7488e90 SHA-256: f2c473f7125719656274dd31fe979650918a322bd01fd8e4d37a370559f8c646
44 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8699

Heuristics 4

  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://medicare-managed-care-manual-2018-chapter-13.mctreadiness.com/nifaxajorirelomo.pdf In PDF document text
    • https://hp-computer-6200-manual.yaguecf.com/vufotopikabujibusu.pdfPDF link annotation
    • https://1st-grade-books-about-weather.vmoga.com/19070832657.pdfIn PDF document text
    • https://environmental-chemistry-colin-baird-solutions-manual.peykweb.com/falutikukomuloge.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/3c0a311b-6293-4097-94ad-83a72d5f1b85/downloads/difference_between_component_and_service_in_angular.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/f4224e20-f24b-4c16-997e-c93418f4356b/downloads/gagelel.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/4d02ebb2-e6cb-4939-adfe-e191eb1694dc/downloads/77455094906.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/94cabba1-b91d-4dc4-bb5a-aed051e4d814/downloads/lulomizofiwufuzamunevot.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/3c0a311b-6293-4097-94ad-83a72d5f1b85/downloads/padapedison.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/9eea3f58-1afc-44e6-b8c6-d1b29c57d2d2/downloads/12177951468.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64edfc81304751b3ba7bd93e/65499746d3e4dde4d6177db3_58351990678.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005cf6d.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005cf6d.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005cf6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5CF6D 16328 bytes
SHA-256: 8094a7199fc6dcb78c932effc213c79fcd628d4ba1d6fc4dfe8514d4f54d92cd
font_01_sfnt_off0005f913.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F913 16072 bytes
SHA-256: dec34dd72be903188d7f6865af3896bdbb08842efa7d31625c0c8bf867bbfd19

Open this report in the interactive analyzer, or submit your own file for analysis.