PDF static analysis report

Static analysis result for SHA-256 10765d8ce87a2e9a…

CLEAN

PDF

641.1 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: ddaa8e9c0f5a1b293f00332d2829aa94 SHA-1: 4e4bd9e6bf07ce4b878e94025ac6a4ff3cd147b3 SHA-256: 10765d8ce87a2e9ae3ff63dc0020f3cf4832677df7f1fefebe7b6a2d529300f4
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.net PDF link annotation
🗂 Part of campaign: shared payload 81976b9c3a 52 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off000002d3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2D3 611556 bytes
SHA-256: dc82aee1e3443a7ea0d57cfa0790cd2a94d23ecaa6d84e28d9bcdd5a22942d53
Detection
ClamAV: No threats found
Obfuscation or payload: likely
850 of 1405 identifiers look randomly generated (e.g. 'ZjyZiyZjyZkzZixZixZixZixZixZixZixZixZixZ'); 2 string-concatenation chain(s) — consistent with name-mangling obfuscation. Carved artifact contains 85 long base64-like blob(s).
stream_017_off000545a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x545A5 591216 bytes
SHA-256: a7a3015fef751fcf3bff17b43de34939d3af3fc1b9638ef1bc7b53ef70e477a5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: NOP sled, heap spray 0x0C
stream_028_off0008a87b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8A87B 54376 bytes
SHA-256: 81353e4653b85ee3a97f99797b69ca250ee5dc241f75a29dce2b01f5838efce8
icc_00_off000000fc.icc pdf-icc-profile PDF ICC profile at offset 0xFC 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00084914.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84914 36776 bytes
SHA-256: 08575a3556e35e709718b127e2cf3128d5fea1a7c694dcf6905eecab9e508724
font_02_sfnt_off00091cef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91CEF 22292 bytes
SHA-256: 9a0af079612a5628793a0eca85d85e8e9c3c55eca991e1c2ecfc6dccef76f6a2
font_03_sfnt_off000955ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x955AD 24448 bytes
SHA-256: 44defc8fbe7d02fabb7bcfbca14a39ace2b03bef22e762c7c7d9b34648329aed
font_04_sfnt_off00098ebc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98EBC 182240 bytes
SHA-256: 49d30d675af959a42c6f04b9b89a27b4d4c955dec2ae2b494cc73b4e7379c5de
font_05_sfnt_off00099b6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x99B6F 129020 bytes
SHA-256: d1e99dafdf2672759a3675eca54f2c8f7e3faf63bcd81c0a9f5ba0fc5dba040e
font_06_sfnt_off0009d5f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D5F0 10648 bytes
SHA-256: e29848391832bea59e4e3a315d12845865375b76bb3ebcfd43a5103b6873bc19

Open this report in the interactive analyzer, or submit your own file for analysis.