PDF static analysis report

Static analysis result for SHA-256 01a17aa53c66bfe6…

SUSPICIOUS

PDF

26.8 KB Created: 2021-05-30 01:43:29 UTC Authoring application: Softplicity First seen: 2026-06-01
MD5: 3cbf65a205baaa2cee92c700b06eeabd SHA-1: 35db3116937de7dc6d3dc07b5031b19c03db4461 SHA-256: 01a17aa53c66bfe6ba2e10dc2e468694f95890e8fb696d8ff4b690cd30feb7da
44 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2905

Heuristics 3

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5249799/normal_60af87d945e04.pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af89d6c5451.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af89b65a8b7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af87c7907aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af880d4265a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af886622158.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af89a645ac1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2cedb3dab1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d0ffcc11a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d1535915a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d196408aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d141b9479.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2cffddc403.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2ce9a18a9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d164f203d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d17427807.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5249799/normal_60af8903ea02c.pdfIn PDF document text
    • http://tod.lods.icu/dls.php?q=Autozone+Service+ManualIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5256695/normal_60b2d18570a67.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: f-static.net 16 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.