PDF static analysis report

Static analysis result for SHA-256 3ed5317436ffb790…

CLEAN

PDF

234.6 KB First seen: 2026-05-08
MD5: 4c37709fb4b0c4f4bfe36fd72d176581 SHA-1: 7c002afc17abddcf4af01b581152497030ad1a99 SHA-256: 3ed5317436ffb790b2a8f32f8014517db39d16652be3a1d0f271c834e78d54fc
20 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0009

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wrpllc.com In PDF document text
    • http://ocsp.verisign.com0Referenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0Referenced by PDF JavaScript
    • http://crl.verisign.com/tss-ca.crl0Referenced by PDF JavaScript
    • https://www.verisign.com/rpaReferenced by PDF JavaScript
    • https://www.verisign.com/rpa01Referenced by PDF JavaScript
    • http://crl.verisign.com/pca3.crl0Referenced by PDF JavaScript
    • http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DReferenced by PDF JavaScript
    • https://www.verisign.com/rpa0Referenced by PDF JavaScript
    • http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0Referenced by PDF JavaScript
    • http://www.adobe.com/typehttp://www.adobe.com/type/legal.htmlReferenced by PDF JavaScript

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000037d3.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37D3 1597 bytes
SHA-256: 1a3303470e66d9f7b9088f3d37355a9925ade6263af8445a0025aaabc4aeebfd
stream_037_off0001892e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1892E 31572 bytes
SHA-256: b5cf08482a734398cdb674c63939484df7a21a874e24c3ffdbae3a3c408cc5d2
stream_049_off0002b923.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2B923 490 bytes
SHA-256: 8c61d8677e0e73097cc961faebf7c175b12a005a1295de6195d54e44e5776bff
objstm_0082_00.bin pdf-objstm-decoded PDF /ObjStm 82 0 obj (inflated) 20090 bytes
SHA-256: 591de641a3001b2877dd571be04936e29ae6c4fdc48632d30eb6e938498ddc4d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 4 long base64-like blob(s).
objstm_0083_00.bin pdf-objstm-decoded PDF /ObjStm 83 0 obj (inflated) 9835 bytes
SHA-256: 3b00b8c996ce1d33a14bd263139c9fd5c934895e5e53d6a690eaf5593f432e90
objstm_0084_00.bin pdf-objstm-decoded PDF /ObjStm 84 0 obj (inflated) 397 bytes
SHA-256: 7d0c8e8526bb5cb94f9e81348aa4e9d1769c8c49474460daf08f201da9e09b85
font_00_sfnt_off00006659.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6659 94875 bytes
SHA-256: 058d11642e857508126df5662db2c7af4bdc1892e73eea6fc33f2605a1fc3c20

Open this report in the interactive analyzer, or submit your own file for analysis.