PDF static analysis report

Static analysis result for SHA-256 55aa6dd774e1f994…

CLEAN

PDF

440.4 KB Created: 2026-05-14 13:49:37 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-18
MD5: 55880c9517107f830ab8dda62d889d23 SHA-1: 27019c28c87bd0170feb013f187b06bc1e5b1580 SHA-256: 55aa6dd774e1f994678ec52a452953b735f30943ec15d80a588cd55a320891dc
6 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off00001fbd.bin)
    • http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensedIn extracted file (font_04_sfnt_off00062e39.bin)
    • https://www.google.com.br/maps/search/-27.5832024PDF link annotation
    • https://www.google.com.br/maps/search/-26.9010209In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off00001fbd.bin)
    • http://scripts.sil.org/OFLIn extracted file (font_04_sfnt_off00062e39.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001fbd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FBD 26760 bytes
SHA-256: f76c1c58a62838db99d653a0f21494055100193820946f8dbf6072213210b170
font_01_sfnt_off00005820.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5820 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off0005e2a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E2A9 22844 bytes
SHA-256: 110d5af963c18774a53cefeab32484370eb9e78240bc94c921e9c02a2e4c0261
font_03_sfnt_off00060b2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60B2E 20684 bytes
SHA-256: 5049bad68abd3d95f4dc406eaf9b6fcbbcc2c900be0e8ef5567c071f0335df42
font_04_sfnt_off00062e39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62E39 21620 bytes
SHA-256: 52c543afa80f2bfdf6faba856dc81d0e0e7c0001314578000a123d3a6064ee7a
font_05_sfnt_off000667a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x667A1 15456 bytes
SHA-256: 07d7aa17d9a69cbe4499e4c99184bf25a8c3ca28f5dfaeeab5f81181b3313974

Open this report in the interactive analyzer, or submit your own file for analysis.