PDF / .VIR static analysis report

Static analysis result for SHA-256 f6dc2e1dc6877e19…

SUSPICIOUS

PDF / .VIR

511.5 KB Created: 2021-08-04 19:43:13 +02:00 Authoring application: birdekir (via PDF Master 1.0.1) First seen: 2024-04-15
MD5: 49869e466748478174ace7c135be1a95 SHA-1: a2079ec070502bcae8dbd3a838b02c36510cd541 SHA-256: f6dc2e1dc6877e19380f4e6899b02cb61289e5f227f33c21a9a9eb61ff8ab4ea
29 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0059

Heuristics 3

  • PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
    PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tlniurl.com/217634 PDF link annotation
    • https://ogacamblith.weebly.com/claris-filemaker-pro-1922233-x64--patch-application-full-version.htmlIn PDF document text
    • https://mytlq.com/advert/parallels-desktop-16-crack/In PDF document text
    • https://descdownwuci.weebly.com/jvc-gx-88e-manual.htmlIn PDF document text
    • https://grifgerzater.weebly.com/download-wallpaper-hd-naruto-kyubi.htmlIn PDF document text
    • https://sterevnove.weebly.com/film-pleure-en-silence-dvdrip-vf.htmlIn PDF document text
    • https://rscheverlee.be/advert/download-mp3-download-lagu-mencari-cinta-sejati-mp3-planetlagu-5-68-mb-mp3-free-download/In PDF document text
    • https://compkotkiere.weebly.com/nyimbo-za-wokovu-pdf-download.htmlIn PDF document text
    • https://searchyours.in/advert/yaksha-prashna-questions-and-answers-in-sanskrit/In PDF document text
    • http://cinurl.com/1c3jh9In PDF document text
    • https://sissypajtas817amfr.wixsite.com/cenelcompreab/post/download-song-green-day-new-song-father-of-all-lyrics-3-48-mb-mp3-free-downloadIn PDF document text
    • https://earralehar1976.wixsite.com/richeapercchick/post/com-mod-clash-royale-mod-apk-v3-3-13-3-1In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000199d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x199D 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000c780.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC780 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.