PDF static analysis report

Static analysis result for SHA-256 29d80dd86a018801…

CLEAN

PDF

11.8 KB First seen: 2026-05-11
MD5: d9d63ac2ff472789b0ef5b5b8032de6a SHA-1: 5dea454c65777b524460f5fb70b7132ba002203c SHA-256: 29d80dd86a018801b181ec04a6af2a73a4d395887ebf41acb23c8805afe51635
22 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.1557

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj-001_000.js pdf-javascript-stream PDF /JS object -1 at offset 0x9AE 656 bytes
SHA-256: a8abcf6f237d8711b5cd344712d407b4a0f57191ce5012c4fd485a78dc7da178
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
app.alert("Test pdf for Fidelis!");
var blue = eval;
var red = unescape;
"FWS"
var rrray = new Array();
var shellcode = "XX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3cXX567dXX8dffXX66deXX9f3c";
javascript_obj-001_001.js pdf-javascript-stream PDF /JS object -1 at offset 0x2D74 164 bytes
SHA-256: 5fabc38280fed595d4f7983dd28c3600c50e9d7bc2a3a240cd6318897ac452ad
Preview script
First 1,000 lines of the extracted script
44 0 <</JS(app.alert\("Test pdf for Fidelis!"\);\r\nvar blue = eval;\r\nvar red = unescape;\r\n"FWS"\r\nvar rrray = new Array\(\);\r\nvar shellcode;)/S/JavaScript>>
objstm_0029_00.bin pdf-objstm-decoded PDF /ObjStm 29 0 obj (inflated) 1654 bytes
SHA-256: 9479d288eec999536c6d7056550094e9f3b2814ccb3e7e6c979227b35cbfa73d

Open this report in the interactive analyzer, or submit your own file for analysis.