PDF static analysis report

Static analysis result for SHA-256 54acd5a496560b56…

CLEAN

PDF

113.1 KB Created: ‰¹P011^­IcŒ/AȈìà#]w•021015_„Fø003Ê1030=(ÊÞId/Ð2ódoâ¡ri021 Authoring application: ‰¹P011^­IcŒ/AȈìà#¦’Pjå017¦ß015RUT015­004 *tՁ¯0ET×ñãú%031Î|ª036025ö001XƟɉŒ9ËÍ000ë (via ‰¹P011^­IcŒ/AȈìà# Ãúԕÿ%ø032%©AMIµ023§ÐªTriIàGš+ñ=½010½>Ÿ›§7Þhu1ùø5­.ƒ010ÂÈP020é010/—íf,035úðúK) First seen: 2026-06-05
MD5: 0cc3e891e1e4bb0e214a22720d1ded62 SHA-1: 2870a0fccba9dc9003c5ca95cec3b3eb9703e0eb SHA-256: 54acd5a496560b56e1959c713d1cbb5afb93be895e1cb7572238a3cb0530ed01
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 113 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wwww.microsoft.com0 In PDF document text
    • http://www.iec.chIn PDF document text
    • https://docs.microsoft.com/typography/abouthttp://lucasfonts.comMicrosoftIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In PDF document text
    • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00001290.icc pdf-icc-profile PDF ICC profile at offset 0x1290 4508 bytes
SHA-256: 73d504558e7d03ef4ff2676ba62c7553ee5bd856b45da2d330e33e012ad61fb3
icc_01_off00002274.icc pdf-icc-profile PDF ICC profile at offset 0x2274 1992 bytes
SHA-256: 49429d4dd70f439f6fa47a298e5ffbd280375d2cbd18708b1e05a34aafe5d219
icc_02_off00005725.icc pdf-icc-profile PDF ICC profile at offset 0x5725 3144 bytes
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e
font_00_sfnt_off00007dd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7DD2 26240 bytes
SHA-256: 96ea4ff306ecf6c3a271dec961eca17c61304cf5f4a058e39a0dbe235055e704
font_01_sfnt_off0000c7d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC7D8 7884 bytes
SHA-256: 687f86a9b78651b678a70dcd3c15cf02d770bc76cad0e9b7dcaee21774747015
font_02_sfnt_off0000da0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA0B 7724 bytes
SHA-256: bb1d1708fa3c3b23156a1c5c15f7357359a4b5486dff1d7111b13a94eb7e6b00
font_03_sfnt_off0000ebf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBF1 4308 bytes
SHA-256: beada47e3d983ec9aa3dd238748650608673722bf99709a17d13dfa8c7fe38b2
font_04_sfnt_off0000f660.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF660 15112 bytes
SHA-256: a7c4412069d11975a9b154850c72486a429a94dea616324844c9a73c426bf658
font_05_sfnt_off00011121.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11121 8412 bytes
SHA-256: f21823420d74a52f41793e9262e0721f7da687bc14e1adeb2f99037dc1a981cc
font_06_sfnt_off000126ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126EA 11532 bytes
SHA-256: 3337c773edb4142cf5cd3ae407d3e874219835d722894ef5ccbe13b76e280a85
font_07_sfnt_off00014020.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14020 10220 bytes
SHA-256: 4c43984b3c3c62e68dadb32ea3d088e7942dad1bb4778c22405490d0ae5a85b3
font_08_sfnt_off00015960.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15960 1252 bytes
SHA-256: ce5eb735b4a14f4bde457c52d0ad75f6ce53e190883c9459f49b41bb3a713bed
font_09_sfnt_off00015cd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15CD0 6296 bytes
SHA-256: 6cfb84c082a5c8c7b653a1889603d5940cff632e800ff3c0b6a2f308258aa42c
font_10_sfnt_off00016aa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16AA5 83164 bytes
SHA-256: 19c65fe8142cd32a4c48a581ec605464f23c642de961708c92ed0221b4c88d3b

Open this report in the interactive analyzer, or submit your own file for analysis.