SUSPICIOUS
26
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0040
Heuristics 4
-
TrueType bitmap font + active content — CVE-2023-26369 related info PDF_CVE_2023_26369_RELATEDPDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
-
Unusually high stream count medium PDF_MANY_STREAMSPDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://sci-conf.com.ua/xvi-mizhnarodna-naukovo-praktichna-konferentsiya-modern-directions-of-scientific-research-development-7-9-09-2022-chikago-ssha-arhiv/ PDF link annotation
- https://sci-conf.com.ua/PDF link annotation
- https://storage.decentralization.gov.ua/uploads/library/file/346/10.12.2018.pdfIn PDF document text
- http://koveladm.gov.ua/In PDF document text
- http://eco.voladm.gov.ua/category/all/locality=9In PDF document text
- https://zakon.rada.gov.ua/go/2456-12In PDF document text
- https://vodres.gov.ua/In PDF document text
- https://sci-conf.com.ua/xvi-mizhnarodna-naukovo-praktichna-konferentsiya-modern-PDF link annotation
- https://sci-conf.com.uaPDF link annotation
- http://vinoge.comIn PDF document text
- https://agrosphere.geIn PDF document text
- http://fermeri.geIn PDF document text
- https://sci-conf.com.ua/xiii-mizhnarodna-naukovo-praktichna-konferentsiya-science-In PDF document text
- http://palanskaotg.org.ua/In PDF document text
- https://vyshniv-rada.gov.ua/In PDF document text
- http://lbsadm.gov.ua/In PDF document text
- https://ustyluzka-In PDF document text
- https://lvivgallery.org.ua/museums/muzey-zapovidnyk-oleskyy-zamokIn PDF document text
- http://visitlviv.net/restaurant/ua/gridnicya/?section=gourmetIn PDF document text
- http://grydnycia.com.ua/?fbclid=In PDF document text
- http://itinery.com.ua/img/objects_content/%D0%BE%D0%BB%D0%In PDF document text
- https://vnebo.ua/files/products/oleskiy_3_1200-800-6254a.1200x800.jpg.webpIn PDF document text
- https://photos.drymba.com/drb/001/056/30616_cd6_ht8pm2.jpgIn PDF document text
- https://comoco.eu/Castelo-de-Castelo-NovoIn PDF document text
- https://zakon.rada.gov.ua/rada/show/v0641729-15#TextIn PDF document text
- https://www.pdau.edu.ua/sites/default/files/node/4753/virtualnarealnist.pdfIn PDF document text
- http://tme.umo.edu.ua/docs/Dod/1_2010/Gorbach.pdfIn PDF document text
- http://grydnycia.com.ua/?fbclid=%20IwAR3G3NTIjgTddhq6Dg2rDjhMRHosgiHm_AZUwnZCMTqNJDoPSv8_kJUB3j8In PDF document text
- http://itinery.com.ua/img/objects_content/%D0%BE%D0%BB%D0%25%20B5%D1%81%D1%8C%D0%BA%D0%BE-2.jpgIn PDF document text
- http://www.history.org.ua/?termin=Rivnensko_Lutska_1944In PDF document text
- http://dspace.onua.edu.ua/bitstream/handle/11300/1098/Lisakova.pdf?sequence=1&isAllowed=yIn PDF document text
- https://www.de.digital/DIGITAL/Redaktion/EN/Publikation/digital-strategy-2025.pdf?__blob=publicationFile&v=9In PDF document text
- https://www.the-village.com.ua/village/city/city-news/292641-yakiy-riven-tsifrovoyi-gramotnosti-ukrayintsiv-doslidzhennyaIn PDF document text
- https://gtmarket.ru/files/research/global-competitiveness-index/Global_Competitive-ness_Report_2019.pdfIn PDF document text
- https://www.bas-soft.eu/soft/bas-mass/bas-accounting/In PDF document text
- https://dilovod.ua/In PDF document text
- https://www.it.ua/In PDF document text
- https://debet.com.ua/In PDF document text
- https://uit.kiev.ua/perevagi-vikoristannja-hmarnoi-buhgalterii-bas-v-umovah-voiennogo-stanu/In PDF document text
- http://nbuv.gov.ua/UJRN/Oif_apk_2018_3_6In PDF document text
- http://zakon2.rada.gov.ua/laws/show/108-95In PDF document text
- https://zakon.rada.gov.ua/laws/show/929_020#TextIn PDF document text
- https://zakon.rada.gov.ua/laws/show/z0392-99#TextIn PDF document text
- https://zakon.rada.gov.ua/laws/show/996-14#TextIn PDF document text
- https://zakon.rada.gov.ua/laws/show/361-20In PDF document text
- https://zakon.rada.gov.ua/laws/show/994_029#TextIn PDF document text
- https://zakon.rada.gov.ua/In PDF document text
- https://www.ukrstat.gov.ua/In PDF document text
- http://www.iae.org.ua/presscentre/archnews/2912-instytut-ahrarnoyi-ekonomiky-prezentuvav-stratehichni-napryamy-staloho-rozvytku-silskykh-terytoriy-na-period-do-2030-roku.htmlIn PDF document text
- http://zakon.rada.gov.ua/In PDF document text
+64 more URL(s)
Extracted artifacts 11
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_188_off003504a9.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3504A9 | 452380 bytes |
SHA-256: 27c9e226ed1d4c926ae4b3700922a430cd8d9956900f4e86c68b381c50cd3ef9 |
|||
stream_190_off003a0943.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3A0943 | 412960 bytes |
SHA-256: aa067beb2ff4cdb34fcaf9775e843d4e1ec25abc4168155f6894886124ef7ac4 |
|||
stream_191_off003bf280.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3BF280 | 321304 bytes |
SHA-256: d4f68a90f55af407bf922a0489b8850f38f00faeb56852a0ce0260d10b2933d1 |
|||
stream_194_off003ffea5.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3FFEA5 | 375596 bytes |
SHA-256: 2a138fa8fa74b559eda05f5fd8bbd258cca0027866973491ffc40caa355feef3 |
|||
font_01_sfnt_off003757b1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3757B1 | 537988 bytes |
SHA-256: 1353513270a633226b001a320ec20b828b104c33ea5bc3ec65cde038632ac8c1 |
|||
font_04_sfnt_off003dfbef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3DFBEF | 291760 bytes |
SHA-256: 78ea47301f2dcdc0e18aa916d0d743e498390c4de566ee69513a296c67379a95 |
|||
font_05_sfnt_off003fa9f9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3FA9F9 | 33176 bytes |
SHA-256: fae8f825f661e03bb862cd292286fc7e1c4f2964fcec00a4f8fd8b1bc6677bca |
|||
font_07_sfnt_off00415b8e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x415B8E | 4064 bytes |
SHA-256: 237c078429d76e267900dbb8d97ec95512a8d8ad5a40bf03e0324b958a8ea094 |
|||
font_08_sfnt_off00416502.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x416502 | 274260 bytes |
SHA-256: 9e9fb11fb53114dffe97b6f3df80d21929281c225844ff993365e0c4a2d7b30d |
|||
font_09_sfnt_off00432211.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x432211 | 222088 bytes |
SHA-256: 19c349721ed7a9ecab9dfee69bf116b9ec760084a1a484e00e2d1e8f032d784a |
|||
font_10_sfnt_off0044b72c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x44B72C | 536772 bytes |
SHA-256: d91116d378346a152a51bf67963f16ab76f1ddfd23f3c9059dc84d8e9bab109e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.