PDF static analysis report

Static analysis result for SHA-256 06c4826f739c5713…

CLEAN

PDF

1.52 MB Created: 2008-08-22 12:08:29 +02:00 Authoring application: Adobe InDesign CS3 (5.0) (via Adobe PDF Library 8.0) First seen: 2026-05-10
MD5: 8aa7cd0d5508df94a1e6e9dfe3c004e3 SHA-1: 3fc5083db0fb86c3a30e3a1ee2f01a6125a363d6 SHA-256: 06c4826f739c5713e0a0a2aefec6b7195955c0d67cce03e663ae18b3464c49bc
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0016

Heuristics 3

  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.swisslife-weboffice.de/home/privateversorgung/angebot/fragebogen.html In PDF document text
    • http://pro.corbis.com/search/searchresults.asp?txt=42-15619666&openImage=42-15619666In PDF document text
    • http://www.monotype.comMonotypeIn PDF document text
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlAllIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/g/img/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.iec.chIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_026_off00079832.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x79832 42960 bytes
SHA-256: 4e34fbabf6e7a82c67bda81ec677cca8bdeeb0c26135eab3224a4cc08bed87c9
stream_099_off00146ddc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x146DDC 72717 bytes
SHA-256: e7bde8a5fe47006bc25b04d1a47d13e045a7342d47126425707b9cf48c51b8c2
stream_105_off001710a0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1710A0 282293 bytes
SHA-256: c07d59cfda47aa4d5dce614c51956de0e37a68128547ccccd393dca343c0333c
icc_00_off0005ecd4.icc pdf-icc-profile PDF ICC profile at offset 0x5ECD4 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_cff_off0006106f.bin pdf-font-stream PDF embedded font (cff) at offset 0x6106F 1962 bytes
SHA-256: ee86f3c8ef309fd753cfd909c340af0b2b58a5fd06a09692619465e2ab0c26a8
font_01_cff_off00061a0b.bin pdf-font-stream PDF embedded font (cff) at offset 0x61A0B 1515 bytes
SHA-256: 8993ab28d3df30a359aa93aaad9038a1c9d4433218d9d2db19526ad7990d5756
font_02_sfnt_off0007f2f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F2F6 21374 bytes
SHA-256: c2665daaf583e4c1cf2aec95b99ca5e88d4143e9f51ee94f0e87ff1368d8baf4
font_03_cff_off00084ae8.bin pdf-font-stream PDF embedded font (cff) at offset 0x84AE8 310 bytes
SHA-256: fabc2788b6afa7a657f6e34a9a1ab52ed6a6e45fbaac8af86421a319206facfe
font_04_cff_off00092f9f.bin pdf-font-stream PDF embedded font (cff) at offset 0x92F9F 3464 bytes
SHA-256: bc9962fdeac7a8787abc99d9f4b80aad71a00d7a3a894a2393dfee78e6a506bc
font_05_cff_off00123d9d.bin pdf-font-stream PDF embedded font (cff) at offset 0x123D9D 3634 bytes
SHA-256: 6f6e1361b75748d9cfc8fef0d85880a8e87770b0fbd6b72be5594c7bcc0fecb9
font_06_cff_off00125269.bin pdf-font-stream PDF embedded font (cff) at offset 0x125269 3895 bytes
SHA-256: 7b4f879b14beea23bfc4c7357b787c183f4e258392a9196455f827359db2c65e
font_07_sfnt_off00126346.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126346 64012 bytes
SHA-256: f42b94256537cd023c08a8f572d49f5c280f7021071e89d6e7de72acad3631ad
font_08_cff_off00139e99.bin pdf-font-stream PDF embedded font (cff) at offset 0x139E99 7441 bytes
SHA-256: a351dabfadc7e6a32222038c9b03cc60ef95e1272f8159a6fa8344c07443783b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.41, consistent with packed or encrypted content.
font_09_cff_off0013b98b.bin pdf-font-stream PDF embedded font (cff) at offset 0x13B98B 7205 bytes
SHA-256: e83f9fa9fef12a184cd432d4ce581e060a5d508c6469cc157e5b36bad8b68d8b
font_10_cff_off0013d97a.bin pdf-font-stream PDF embedded font (cff) at offset 0x13D97A 514 bytes
SHA-256: 4f75319215c54352533a7ea481427e2433bd461b01f8936c610801e61be37f86
font_11_cff_off00140331.bin pdf-font-stream PDF embedded font (cff) at offset 0x140331 12993 bytes
SHA-256: ebf0573bdfe2c1272a68f3913b96ee6f34bb057413e5ae13e324688ca4d79328
font_12_cff_off00143a03.bin pdf-font-stream PDF embedded font (cff) at offset 0x143A03 9213 bytes
SHA-256: 8b18d8e602ec5330184da113556471053f305bc51c541c29167e96054b4876df
font_14_sfnt_off00160514.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x160514 5884 bytes
SHA-256: 99d10c50aa89fe5527c4b0f202a8bb43afb2efc5b94e904e94fdd1574d129b35
font_15_sfnt_off001616c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1616C3 61251 bytes
SHA-256: ac83ff3f4069d8054f7cab93a9ad666defe8651373573b762986d236983c8859
font_16_sfnt_off0016a493.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16A493 51665 bytes
SHA-256: 364da59bdcc7524dc0ca1878e9f3043825ede93de0768feeabdb4f19eb52d2c0

Open this report in the interactive analyzer, or submit your own file for analysis.