PDF static analysis report

Static analysis result for SHA-256 205b86eb2d4c0c84…

SUSPICIOUS

PDF

19.0 KB First seen: 2026-07-19
MD5: ba01ab5f514a77b4f8263addb41bf711 SHA-1: 6459e32c7b1f6fd152e20af53ff2c203767fba6f SHA-256: 205b86eb2d4c0c8474cf696577f14d6ecb49e0d7778f107dcd46e4764b4b3e10
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://Jeep+Manual+Transmission+Parts PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5250166/normal_60af9d98d49e0.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250183/normal_60af9f4aad7f0.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250098/normal_60afa4fcb7859.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250040/normal_60af98d119198.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250067/normal_60af9cda3feb1.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250067/normal_60af9f2cdc2bf.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250243/normal_60afa2e32efcc.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250166/normal_60afa000500f8.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b32470e7aae.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b324302fc5e.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b323443dd39.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b323734372b.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b324f0b1b7c.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b325017bd79.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b32511480ed.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b324e0786ee.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b325210aa83.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257079/normal_60b325313dfc2.pdfIn extracted file (objstm_0039_00.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0039_00.bin pdf-objstm-decoded PDF /ObjStm 39 0 obj (inflated) 6141 bytes
SHA-256: 3baf7b7e8afffef0463f9f9bb9ebb951c7a651c6208a91376a38521fb1077dd5