PDF static analysis report

Static analysis result for SHA-256 3e0ad9ddf44a6382…

CLEAN

PDF

500.9 KB Created: 2025-07-23 11:51:57 +03:00 Authoring application: Microsoft: Print To PDF First seen: 2026-05-13
MD5: c1cc26ddbdd5f9b63cd956185dbdb634 SHA-1: 8ce901d5caa6edfc8bcb58044607349aab32f14a SHA-256: 3e0ad9ddf44a6382bb14050bdfb1721b6597d058c5ea7499f016a305dca0357e
10 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wwww.microsoft.com0 In extracted file (stream_002_off0002556c.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_002_off0002556c.bin)
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In extracted file (stream_002_off0002556c.bin)
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0lIn extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0In extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pkiops/Docs/Repository.htm0In extracted file (stream_002_off0002556c.bin)
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In extracted file (stream_002_off0002556c.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0002556c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2556C 392952 bytes
SHA-256: f0d081ea30957be594fe494ea08274285633e67ae05894b4b8ef119dcae98c21
font_00_sfnt_off00000091.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91 346500 bytes
SHA-256: fda3d98d204a109bc3b2e564297994ef7b4494fd961aaa0e238fdda8f428c161
font_01_sfnt_off000118e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118E4 281896 bytes
SHA-256: ff01225e608a259f30373ab7724cb82c9eb61025c2d950caf365d83eed1f58bd
font_03_sfnt_off0003ee83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EE83 334972 bytes
SHA-256: 279f9e686b712534d200fc2e2cff3d183fbc4e3385be8bf198ec11cea78df80b

Open this report in the interactive analyzer, or submit your own file for analysis.