PDF / .VIR static analysis report

Static analysis result for SHA-256 f9d13c2b54421df4…

SUSPICIOUS

PDF / .VIR

283.7 KB Created: 2023-07-05 21:40:37 Authoring application: Karbon First seen: 2024-11-09
MD5: 83e0301d3e350542db338105eae0ca53 SHA-1: f0d1cffd190b31b38b3e1660e71665f5fe2bc108 SHA-256: f9d13c2b54421df40a47302f91c48a5b2a3b47372484ef695e73c4629abf615c
44 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9653

Heuristics 4

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://guide-de-coupe-tondeuse-remington.twilighttealounge.com/soxojubelanuxibezez.pdf PDF link annotation
    • https://livre-histoire-du-p-re-castor.chanceforchanges.com/65069209390.pdfIn PDF document text
    • https://algebra-book-1-pdf.deaardbol.com/dunuretomuzup.pdfIn PDF document text
    • https://epub-to-pdf-converter-large-file.slothoki96.com/pitajego.pdfIn PDF document text
    • https://e-m-coding-guidelines-worksheet-2023.freshfabrication.com/96680014053.pdfIn PDF document text
    • https://parrot-zik-3-manual.workforceok.org/31299545600.pdfIn PDF document text
    • https://michael-jackson-single-malt-epub.superbowlstarttime.net/saneni.pdfIn PDF document text
    • https://livre-adulte-sur-les-highlanders-en-pdf-ekladata.soforso.com/zafovat.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/de43da9e-bc77-4e56-a909-0e72ba746cf9/downloads/81558261677.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/63a37d2a-c89b-4d92-869e-3bda8a681a81/downloads/how_to_turn_on_learning_games_in_iready.pdfIn PDF document text
    • https://uploads-ssl.webflow.com/64ee110defbeae416adabe6e/654c2430ab5667cc6ba7fcf7_8807268672.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/25f05580-ef12-405d-a6b9-594f4a362aa8/downloads/seluvepazujesopivinapot.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00041a85.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00041a85.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00041a85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41A85 10956 bytes
SHA-256: c7a43a2f8e4b326fd1f4085c17e4713f570ef35f352e0b8680663b6e658daefe
font_01_sfnt_off00043403.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x43403 17528 bytes
SHA-256: 8013e136ba983ba9a7efae94b78dc2c50255f2275c1e43d9e2271d7dbd4e9d84

Open this report in the interactive analyzer, or submit your own file for analysis.