PDF static analysis report

Static analysis result for SHA-256 0e6ba3054405b557…

SUSPICIOUS

PDF

97.4 KB Created: 2021-12-05 10:11:34 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-07-11
MD5: e8cf5651e0f9f753298333c8008175b7 SHA-1: e85f35a21365a6de7dc1cf0705157d7b5485303b SHA-256: 0e6ba3054405b557f0984913cfe7e031e0a050b46fcc15ef92d80386e90abf22
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0347

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9781594770265&kwd=Golden%20Elixir%20Chi%20Kung PDF link annotation
    • https://static.s123-cdn-static-a.com/uploads/4649808/normal_61aa914318ad7.pdfIn PDF document text
    • https://files8.webydo.com/9588662/UploadedFiles/FDE69F41-865D-E84E-669E-A943C46C667E.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4649559/normal_61ab9b2e75f75.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4659077/normal_61abd3b06ac5a.pdfIn PDF document text
    • https://files8.webydo.com/9588601/UploadedFiles/91476FA9-FC56-015F-DB05-3C32E379F569.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4650750/normal_61aad4d7192fc.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00012885.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012885.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12885 21728 bytes
SHA-256: e6c9ec87a7d39fe2220c0c2a8155080497892f35c944f269f198e4c98b687a30
font_01_sfnt_off00015b30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15B30 18764 bytes
SHA-256: 7010e1fc45728ca7d74317f8c9c95303aa39cfdc9d63bd885b378f3077d59989

Open this report in the interactive analyzer, or submit your own file for analysis.