A ZIP appended after PDF EOF contains a member that matches a CVE rule.
Extracted child file matched a ClamAV malware signature.
File starts with GIF magic but contains a PDF body at a later offset.
Three or more independent structural-anomaly heuristics fired on this file.
File was submitted as .pdf but does not contain a PDF header.
ZIP local-file header appears after the last %%EOF in a PDF.
A file carved from inside the sample matched static suspicious-content checks.
This combination of heuristics has fired multiple times before, mostly on malicious files.
%PDF- magic and %%EOF trailer found inside a text document.
Non-empty bytes precede the first ZIP local-file header.
Format-neutral static scan produced the finding.
PowerPoint record anomaly: PowerPoint Fopt Complex Data Overflow.
PowerPoint record anomaly: PowerPoint Fopt Property Table Truncated.
An unusual combination of heuristics that has been flagged on at least one prior file.
Normalized parser/payload feature set is rare and has appeared on a flagged file before.
Analysis exceeded the wall-clock timeout; phases that had completed before the timeout are preserved.
One or more URLs were extracted from the document bytes but were not attributed to any other specific heuristic.
A capability-only Office macro carries a cryptographically valid, CA-issued (non-self-signed) VBA publisher signature and nothing corroborates malice, so its score was downgraded to clean.
Core static analysis completed; optional late-stage decoders were skipped after the per-file soft deadline.
A ZIP appended after PDF EOF could not be fully scanned.
A scanner failed, timed out, or hit an output/resource cap before analysis completed.
File format was not recognised by the analyzer.