PDF / .VIR static analysis report

Static analysis result for SHA-256 fd93140aac4e86d3…

SUSPICIOUS

PDF / .VIR

19.3 KB First seen: 2024-12-24
MD5: da8ad7712512c3dc387b17ffa32fb97f SHA-1: edc3271d736fcdc0023db8b727a3b087932fc030 SHA-256: fd93140aac4e86d34888b6f6d401f569c9ea9cc6c1124d14c8c42632df7c9972
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tod.lods.icu/dls.php?q=Cmp756+Manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5256297/normal_60b2992f9c0c5.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256331/normal_60b29c490c9a8.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256291/normal_60b29ced98c26.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256291/normal_60b29bb6eb864.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256308/normal_60b296d042073.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256291/normal_60b291f2e0605.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256263/normal_60b290d6720a7.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256327/normal_60b29356caa1f.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e18d77679.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e51274f15.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e2a514536.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e11d05e0b.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5b01fc46.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5d193919.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5912d0fc.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5812916a.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5c23b6a6.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256768/normal_60b2e5a0e5123.pdfIn extracted file (objstm_0039_00.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0039_00.bin pdf-objstm-decoded PDF /ObjStm 39 0 obj (inflated) 6253 bytes
SHA-256: 9ba3e3f80a28d2fae2d23a43a77f8dae0998252e3bb6a8fe30c9fa1c2c2a987b