PDF static analysis report

Static analysis result for SHA-256 222bb0b3025cab65…

CLEAN

PDF

826.1 KB Authoring application: Skia/PDF m148 Google Docs Renderer First seen: 2026-05-28
MD5: 6e37f40387a117244a226665127ffd13 SHA-1: 882b03c3a7f7e8fe1f64c9631d2f670e6b33ee86 SHA-256: 222bb0b3025cab6582ca9a242005e2f840afa5f4c5d40b2b46d619635ac4e073
6 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://movietimes.online/en/movie/1226863/the-super-mario-galaxy-movie PDF link annotation
    • https://urslink.club/filmynewsIn PDF document text
    • https://urslink.club/filmynews)/TypeIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_06_sfnt_off0009579a.bin)
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0aIn extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0In extracted file (font_06_sfnt_off0009579a.bin)
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In extracted file (font_06_sfnt_off0009579a.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^In extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0��In extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/pkiops/docs/primarycps.htm0@In extracted file (font_06_sfnt_off0009579a.bin)
    • http://www.microsoft.com/TypographyIn extracted file (font_06_sfnt_off0009579a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_043_off000785ca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x785CA 155108 bytes
SHA-256: fe18590d2be765d5c8328581ee8825887522ae362dc0dbfc190533194096e254
icc_00_off000000c2.icc pdf-icc-profile PDF ICC profile at offset 0xC2 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off0006af81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6AF81 28964 bytes
SHA-256: 054600b9810a49607997da693ec827a114652608040eee2e65d7bb09476a5098
font_01_sfnt_off0006fb55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6FB55 52068 bytes
SHA-256: 05e6c1b0c23fe06e3a978c5b3b989f494654fe3e3a2b134a061e0f09e48bcb89
font_02_sfnt_off0007107d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7107D 139952 bytes
SHA-256: 87ef82f65b646c6cad4ec3c719271ac79b5ef02d5741ff7859ba60fac2668a4e
font_04_sfnt_off00084ade.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84ADE 30032 bytes
SHA-256: c8f719d541a44ffbd940f988e71286172e0f89c2272592d7396a75eac4f1bfbb
font_05_sfnt_off000895f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x895F7 14520 bytes
SHA-256: b74270f8cbbcd38ceeaa924df6c9721627b9a000567390b106797ca57f394121
font_06_sfnt_off0009579a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9579A 341088 bytes
SHA-256: 3a60b3521c9988b7d33e96884da5d4d9085cf05315ec779f981fec150b91b31a
font_07_sfnt_off000a84c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA84C9 340860 bytes
SHA-256: 81c73bfed57e0a1ef57c75af4994831674d8715a02b0b0855fc63b47917ed810
font_08_sfnt_off000bdab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBDAB9 340712 bytes
SHA-256: a0f25abac5384e8f7144b3385b484ad1b223ffb47703304bbc691a64711a3cab

Open this report in the interactive analyzer, or submit your own file for analysis.