PDF static analysis report

Static analysis result for SHA-256 3ec86db8d4abeda0…

CLEAN

PDF

207.1 KB First seen: 2026-05-11
MD5: fce0e2f6bc4a37787ef8dfe3fa8ccd6f SHA-1: f2e00370410d92d6530cd1b9ef699302f299b2cb SHA-256: 3ec86db8d4abeda08283fa4cd171075ebc99d6181c32ce080ff48c8b0f69bd10
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_4937_00.bin pdf-objstm-decoded PDF /ObjStm 4937 0 obj (inflated) 13135 bytes
SHA-256: eab5b6f1fe61bb4e888636c41a41fa8076ac723a572549f7ef098d3eb552c3eb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
objstm_0075_00.bin pdf-objstm-decoded PDF /ObjStm 75 0 obj (inflated) 12166 bytes
SHA-256: 22995eb1e86a80a6d05e6efc588d937b4284da8072441259d26981b6a7481dac
objstm_0076_00.bin pdf-objstm-decoded PDF /ObjStm 76 0 obj (inflated) 9748 bytes
SHA-256: 8b5db09e2e778e8ba1e4e594108695f7a52ea1f68f96e71cfb89826d7bc40db2
objstm_0077_00.bin pdf-objstm-decoded PDF /ObjStm 77 0 obj (inflated) 10089 bytes
SHA-256: 91497532146da00e72b98d359d26b5d9453c29710a99d614406ce7586a6d1531
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
font_00_cff_off00003a10.bin pdf-font-stream PDF embedded font (cff) at offset 0x3A10 8782 bytes
SHA-256: 5e4855c36e84f5a471cdd366b6e1164d752234ad8b53b4639ca7fcb9aeffdccc
font_01_cff_off000056c3.bin pdf-font-stream PDF embedded font (cff) at offset 0x56C3 7345 bytes
SHA-256: fde573ff922cf4b39f27e4de3be6048b0a18684e7aec35b492091cad06354a18
font_02_cff_off0001a70a.bin pdf-font-stream PDF embedded font (cff) at offset 0x1A70A 4543 bytes
SHA-256: 9e22a1a3bb84fe72ee4ddb30da74ca3ad4254ad9fa30b27b83de09a0dc70d244
font_03_cff_off0001c48e.bin pdf-font-stream PDF embedded font (cff) at offset 0x1C48E 7375 bytes
SHA-256: cfa4f0c937c4904f23a51a7fa6ce3cc236d0742ed916c4a997f059a31400dbdf

Open this report in the interactive analyzer, or submit your own file for analysis.