PDF / .VIR static analysis report

Static analysis result for SHA-256 fbc27df493f58aeb…

SUSPICIOUS

PDF / .VIR

27.7 KB Created: 2021-06-01 01:37:08 UTC Authoring application: Softplicity First seen: 2025-01-08
MD5: d89589afc6fc39872601c995358b3e43 SHA-1: b4828fff3c41da580d795dcadd213f1846e6d719 SHA-256: fbc27df493f58aeb5a18143831fc5a04f4b08d5807d46cf8df1cbcdb03645718
34 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3249

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5249599/normal_60af77ec8b334.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af6ea716b3f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b5711706988.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af79a6d0720.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af7317323de.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af773a20bd9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af7578d4558.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af7873962c3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b56f7c47eaf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b573174d373.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b572df86daa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b572cd55eb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b572bb5ac8b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b5722b4af39.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b5700df146a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b572f226b7c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5261592/normal_60b573062517f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249599/normal_60af7965ee95e.pdfIn PDF document text
    • http://bet.lods.icu/dls.php?q=Morris+Minor+ManualIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: f-static.net 15 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.