PDF static analysis report

Static analysis result for SHA-256 03ec44a251b452c9…

SUSPICIOUS

PDF

19.4 KB First seen: 2026-05-10
MD5: 5dd6554938e4ccac6f3998e1b91381cd SHA-1: ddb6eddda87d345f5d87e5def223b8355f616d72 SHA-256: 03ec44a251b452c9c851eb4fa973c2d6ae2efc014640954a5509c3f64bb40c61
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fed.litd.icu/dls.php?q=Searchable+Mule+3010+Trans+Gas+Factory+Service+Manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5255647/normal_60b2470d96541.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255646/normal_60b248bae08a6.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255646/normal_60b2474c590fe.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255647/normal_60b2471f00a41.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255646/normal_60b2466749eec.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255664/normal_60b2483ba5218.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255656/normal_60b248750d038.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5255646/normal_60b24860c309e.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30ac212c1d.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30af123a7e.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30b10276f9.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30ae18b984.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30b00bd6ca.pdfIn extracted file (objstm_0035_00.bin)
    • https://cdn-cms.f-static.net/uploads/5256946/normal_60b30ad1b61f4.pdfIn extracted file (objstm_0035_00.bin)
🗂 Part of campaign: f-static.net 11 samples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0035_00.bin pdf-objstm-decoded PDF /ObjStm 35 0 obj (inflated) 5645 bytes
SHA-256: aec84f81750fe004356ba3c6c93b0a8fa73f1bb72ee1f2dbcd5992e1d60082cd