Malicious PDF / .VIR — malware analysis report

Static analysis result for SHA-256 f49078f773aa9739…

MALICIOUS

PDF / .VIR

43.9 KB Created: 2022-11-30 16:50:07 +00:00 Authoring application: simqui (via mPDF 8.1.2) First seen: 2025-02-17
MD5: ae82c407e0bc43375e0bdd3b5a578cfb SHA-1: ed7f3d84e1c249f32b7c351865f5e9309fd074e0 SHA-256: f49078f773aa9739b3b7535564822306e79044a6c8c4f2ced6d38979b45ef53c
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardlyfind.com/culled/QXV0b0NBRAQXV/celibate.ZG93bmxvYWR8UHQwYVdSdGZId3hOalk1T0RJME9UTTBmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ.monadnock.jeuness=kolossi.psychopaths.richt PDF link annotation
    • https://ukrainefinanceplatform.com/wp-content/uploads/2022/11/cariamme.pdfIn PDF document text
    • http://leasevoordeel.be/wp-content/uploads/2022/11/AutoCAD__Crack_With_Product_Key.pdfIn PDF document text
    • https://recipesja.com/wp-content/uploads/2022/11/AutoCAD.pdfIn PDF document text
    • https://bskworld.com/wp-content/uploads/2022/11/wynhar.pdfIn PDF document text
    • https://www.mtcpreps.com/wp-content/uploads/2022/11/AutoCAD_Incl_Product_Key_Free.pdfIn PDF document text
    • http://hardlyfind.com/culled/qxv0b0nbraqxv/celibate.zg93bmxvywr8uhqwyvdsdgzid3hoalk1t0rjme9uttbmshd5tlrrd2zid29uu2tnvji5evpiqnlawe56suz0wvrvefnvru1nvmpjz1vfukdyuq.monadnock.jeuness=kolossi.psychopaths.richtIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_015_off00004839.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_015_off00004839.bin)
🗂 Part of campaign: dubaipropertyrentals.net 262 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_015_off00004839.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4839 19780 bytes
SHA-256: 4fa1e1f62893db1504b694ba157ca733dbc9a64fe6775bec7c5c9e8d41f3a745
font_01_sfnt_off00007bec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BEC 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8

Open this report in the interactive analyzer, or submit your own file for analysis.