PDF static analysis report

Static analysis result for SHA-256 340ffac242562985…

CLEAN

PDF

4.24 MB First seen: 2021-09-22
MD5: 03e30e1baef1f8ae587ef49820332c00 SHA-1: 4ab7aa3dbd15ce7e5b50a3827c76be99b5cfa11b SHA-256: 340ffac24256298566f185f5a154d1c4bb5af88bffbd18d0fbbbcb4fcf17c488
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0027

Heuristics 3

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_018_off0000db01.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDB01 44352 bytes
SHA-256: d49c6ff167e279793229333aa62586608c5ae7ed68062cbfbc4b78f1abaae7ff
font_00_cff_off0000602b.bin pdf-font-stream PDF embedded font (cff) at offset 0x602B 21732 bytes
SHA-256: 7fc5e55fa0048914c4f547c1497fa9cd8a1695bfb6b1b61585f702621ab47f01
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.43, consistent with packed or encrypted content.
font_01_cff_off0000aff1.bin pdf-font-stream PDF embedded font (cff) at offset 0xAFF1 12932 bytes
SHA-256: 11552d37c0822db5ee84ac07d6fc17067b15fbe2db852b3cf86df8aac1e5fcac
font_02_cff_off001d9ae0.bin pdf-font-stream PDF embedded font (cff) at offset 0x1D9AE0 1035 bytes
SHA-256: fdfcccf219633be52d999b75233cda3af82ae5ddc6365ba0f202b0c393c9b4cb
font_03_cff_off00422e12.bin pdf-font-stream PDF embedded font (cff) at offset 0x422E12 3821 bytes
SHA-256: f70e74eed4cede884c6f3c8c5d0f183085ed26e7c0c8f2941165f8f581ea5746
font_04_cff_off00423b91.bin pdf-font-stream PDF embedded font (cff) at offset 0x423B91 6029 bytes
SHA-256: 9f7d5c35ce67f309d676f0e48a5e3a9026e76f96d5e0d177e8573540a1df9875
font_05_cff_off00424f40.bin pdf-font-stream PDF embedded font (cff) at offset 0x424F40 3135 bytes
SHA-256: dd705e92bb708878323ead04843f10e81566afa98bbee251ad6a473ae9abbe89
font_06_cff_off00425b66.bin pdf-font-stream PDF embedded font (cff) at offset 0x425B66 2102 bytes
SHA-256: 77e08b7c2dff9dc8dbb61cd00b7f70efd89c4548cb520fae8daa5804bc90a6e6
font_07_cff_off0042cea3.bin pdf-font-stream PDF embedded font (cff) at offset 0x42CEA3 5180 bytes
SHA-256: aebb5deaf2ddc99aedb64ee09d49ef1b3439f2060d51e728d354ed0d9031f35d
font_08_cff_off0042e5fb.bin pdf-font-stream PDF embedded font (cff) at offset 0x42E5FB 6585 bytes
SHA-256: 0ef49956c1b74d291b58771d9328c22953f275917be36d0e16537a77603414be
font_09_cff_off0042ffd9.bin pdf-font-stream PDF embedded font (cff) at offset 0x42FFD9 7944 bytes
SHA-256: c0973b8b86b1f9459e5149070c0b27dc4d6d2cd9ba9894d612c0f73c6fba6cd2
font_10_cff_off00431c29.bin pdf-font-stream PDF embedded font (cff) at offset 0x431C29 26466 bytes
SHA-256: a695a3f5560536163d521c621f6da519bfeb9044d467bade014f3f0ee3a1fab6
font_11_cff_off00437397.bin pdf-font-stream PDF embedded font (cff) at offset 0x437397 13748 bytes
SHA-256: 9315017e5e83e3f19b1fd28dc3e40d399154d4c6fe3db867fabb5c141e87de28

Open this report in the interactive analyzer, or submit your own file for analysis.