PDF static analysis report

Static analysis result for SHA-256 3f9ff8254ec1e421…

CLEAN

PDF

35.1 KB Created: 2026-05-27 10:49:23 +00:00 Authoring application: Pdfcrowd.com v20240430.121 (via Skia/PDF) First seen: 2026-06-04
MD5: 59eab124f24caae4b140ef7f7e7ab221 SHA-1: 99326f9694614cb4db83bcd7cd369a638f3b928f SHA-256: 3f9ff8254ec1e4217c71441dcb03df748a70e6e631e513438dccfe403072dc48
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0112

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amtso.org/check-desktop-phishing-page/ PDF link annotation
    • https://pdfcrowd.com/api/html-to-pdf-api/?ref=pdfIn PDF document text
    • https://pdfcrowd.com/?ref=pdfIn PDF document text
    • https://pdfcrowd.com/html-to-pdf/?ref=pdfIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002333.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2333 14424 bytes
SHA-256: aa622290688b267cf7b809adc78408d7f5a35e59040cdec1b762d4d0e4a500dc
font_01_sfnt_off0000340e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x340E 20580 bytes
SHA-256: 0300cf62c9e5cc4d80acba5b1b504ca7d85f85f0c7bead0918730d690538eee1
font_02_sfnt_off00005180.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5180 11488 bytes
SHA-256: fb31e19faf0e3800ab5850b5148c59bf27b2f138fcbd1d688454cd8390282f8d
font_03_sfnt_off0000734a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x734A 7172 bytes
SHA-256: 5aef4dee0e1a39ba0f2ba9a0cec3070fab40650363ca1e8f9e7f61d429fab295