PDF static analysis report

Static analysis result for SHA-256 3050d75d5dc63d12…

CLEAN

PDF

24.11 MB First seen: 2026-05-13
MD5: 5cd49e845fc143ecb398d161bab3da5a SHA-1: 9e847ec126c1d5b7af2c65a4d8002ca4e0637c12 SHA-256: 3050d75d5dc63d1242722f52b9f538376e3ee04844f624d33d2a072549864589
12 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0190

Heuristics 3

  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/exif/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/photoshop/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://www.iec.chIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 20

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off00256d8a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x256D8A 606000 bytes
SHA-256: ec909a79102811af80b6567abb033d103eb276c6ab56a83bcae6bcd9ce4af9b7
stream_017_off0058e252.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x58E252 2156400 bytes
SHA-256: 2cbbf2b20cb765cc6875bd0d72bea239b625eafd411d9ae45c7ae6ed9598c298
stream_022_off007543ef.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7543EF 967440 bytes
SHA-256: d330ffc5a0193b50b79c79ef85f0b70a45a892adb8fe5b9f1f9bba988254c559
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.68, consistent with packed or encrypted content.
stream_028_off0093f3c4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x93F3C4 910860 bytes
SHA-256: 93fa4df2c0ec199459039dd96aef65abe4d3dd69212ee415847b9764177eedc5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.71, consistent with packed or encrypted content.
stream_031_off009e4ad8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9E4AD8 443904 bytes
SHA-256: 8bd49f0dcd5407d854a0fb7793d31e0d77f7fbb4d7f37946aaddc15b4f586ba8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.82, consistent with packed or encrypted content.
stream_034_off00a45d03.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA45D03 2254275 bytes
SHA-256: abb897c7820505f38c455cf0e27783535879323c91713b8dcf5291cdc18eb517
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.46, consistent with packed or encrypted content.
stream_037_off00bffcae.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBFFCAE 1865070 bytes
SHA-256: 9e09182a127056cae84b63ddedebae76953c7905225f1b2342aec8a8f36b2aa1
stream_041_off00d59a8b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD59A8B 342900 bytes
SHA-256: e3758d6c4f92b65bc7d7bb8b2284657091a6f17b608eec06b308eddd41c26899
stream_044_off00d8b9c4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD8B9C4 2239488 bytes
SHA-256: 679652c53ceaaf392f8caa32359547c8d743cfd3024d19edc31d880709f763a8
stream_049_off00f2f0b9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF2F0B9 3195072 bytes
SHA-256: 8a3f13d60739f3a2d461a984afc4c482bcddfffc1cddfbc682cf314423113866
icc_00_off00104c34.icc pdf-icc-profile PDF ICC profile at offset 0x104C34 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
icc_01_off001056f1.icc pdf-icc-profile PDF ICC profile at offset 0x1056F1 1992 bytes
SHA-256: 49429d4dd70f439f6fa47a298e5ffbd280375d2cbd18708b1e05a34aafe5d219
icc_02_off001863b5.icc pdf-icc-profile PDF ICC profile at offset 0x1863B5 3284 bytes
SHA-256: dea71d28e28ead2b139117766bf5cb269b8006f0ae61050b1b539abb296e4551
icc_03_off00d58e15.icc pdf-icc-profile PDF ICC profile at offset 0xD58E15 560 bytes
SHA-256: 304f569a83c1e5eddaddac54e99ed03339333db013738bb499ab64f049887e28
icc_04_off01289669.icc pdf-icc-profile PDF ICC profile at offset 0x1289669 60960 bytes
SHA-256: 83174717332326ddc198d9df188a4daec27b8979ba152cebbfc470c793d0bb11
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.93, consistent with packed or encrypted content.
font_00_sfnt_off01811b8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1811B8E 4648 bytes
SHA-256: 7e742768cc2370323908bacc2a11aaa72d573a87563dcab7ef85eaca95307a8c
font_01_sfnt_off01812a6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1812A6E 9532 bytes
SHA-256: 6f444f56594ffa8eab4ab5ac384ab93600a4d93d92c79df64f6560f772d64bff
font_02_sfnt_off01814495.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1814495 8992 bytes
SHA-256: d20a177f36132368f2540779195d5c199f5ee6506e0565017863f4fd7d5a3f49
font_03_sfnt_off01815b89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1815B89 19492 bytes
SHA-256: 23b8881d3904222e60f3adcb8f9f73bd6f4ed4ccc0c532babdb8f84ee4466833
font_04_cff_off0181866b.bin pdf-font-stream PDF embedded font (cff) at offset 0x181866B 1625 bytes
SHA-256: 9aa543eba3ac0347644c9921a4d097ddbec296e56dc80fe9ba331c2f872ca502

Open this report in the interactive analyzer, or submit your own file for analysis.