PDF static analysis report

Static analysis result for SHA-256 2ea2418593fec43a…

CLEAN

PDF

5.02 MB Created: 2026-05-08 09:37:49 +00:00 Authoring application: Pdfcrowd.com v20240430.121 (via Skia/PDF) First seen: 2026-05-15
MD5: f558707e1f5d6b12b9cfb944790e04ba SHA-1: 2b1a70271f07b8cdc3477b4ee5552a1e03e9d850 SHA-256: 2ea2418593fec43a42bb5c0da60429dbb134430d9a5a48d3f0f12f64596a5967
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0593

Heuristics 3

  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pdfcrowd.com/api/html-to-pdf-api/?ref=pdf PDF link annotation
    • https://pdfcrowd.com/?ref=pdfIn PDF document text
    • https://pdfcrowd.com/html-to-pdf/?ref=pdfIn PDF document text
    • https://goforlease.com/dealers/AutoFredoIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off0000020d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x20D 2073600 bytes
SHA-256: 29946098ac79ca3f124acfa3f2ae0abedb9bcb0e0eb42ba9cf99ab8e8c0e568b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x06 Carved artifact entropy is 7.41, consistent with packed or encrypted content.
stream_002_off0013dead.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13DEAD 2073600 bytes
SHA-256: 1f78a7cadb087383c7937bd8b8e79883484d3e4409d1ea7bc3ab30212a2ed806
stream_004_off0025a410.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x25A410 2073600 bytes
SHA-256: 0034f4d78100b328690c736332e741307fcbb345bc776b0dead9296bc7a31858
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.55, consistent with packed or encrypted content.
stream_006_off0038e5a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38E5A5 2073600 bytes
SHA-256: 32d57df929415a5163683ed6649309c141d49e603d6c4aa37c7bd95ce9667c5e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.85, consistent with packed or encrypted content.
stream_013_off004fbefa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4FBEFA 37636 bytes
SHA-256: 630876834956c33c42d803ffe6d21f7c86f1c68e1166fbae382d5e1c6f270046
font_00_sfnt_off004f5ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F5AE4 38104 bytes
SHA-256: 4c77fd46415a596c85f7f757ed8865387d30798fc654dbb1287e4953be417ee9
font_02_sfnt_off00501f67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x501F67 1252 bytes
SHA-256: 4db584e84a69daa129bee04bf00d9d0f0f5b11462250b1bd6905a0b2e1f5828f
font_03_sfnt_off005025bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5025BD 11488 bytes
SHA-256: fb31e19faf0e3800ab5850b5148c59bf27b2f138fcbd1d688454cd8390282f8d
font_04_sfnt_off00504788.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x504788 7172 bytes
SHA-256: 5aef4dee0e1a39ba0f2ba9a0cec3070fab40650363ca1e8f9e7f61d429fab295

Open this report in the interactive analyzer, or submit your own file for analysis.