PDF static analysis report

Static analysis result for SHA-256 2670720e9ea9ac63…

CLEAN

PDF

15.41 MB First seen: 2026-05-08
MD5: 3f17b01bdd28c91bee2ff1b1551116c3 SHA-1: ecbe2c61ec786b0cd0005ce2ff3d3c5a6bc8962a SHA-256: 2670720e9ea9ac63a4b8160790245c00f1a379b6d34ec6ca05e1fd525d258be2
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1086

Heuristics 3

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • https://www.cambridge.org/corePDF link annotation
    • https://doi.org/10.1017/CBO9780511626241In PDF document text
    • https://www.cambridge.org/core/termsPDF link annotation
    • https://doi.org/10.1017/CBO9780511626241.001In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.002In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.003In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.004In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.005In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.006In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.007In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.008In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.009In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.010In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.011In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.012In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.013In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.014In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.015In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.016In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.017In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.018In PDF document text
    • https://doi.org/10.1017/CBO9780511626241.019In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00ad4118.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAD4118 9364 bytes
SHA-256: f1075683eb26fc4f1d04452465e050570f38023c2dee4f7b32c69807a6844f28
font_01_sfnt_off00b01bbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB01BBC 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa

Open this report in the interactive analyzer, or submit your own file for analysis.