PDF static analysis report

Static analysis result for SHA-256 570d1153ab3b2f6e…

CLEAN

PDF

773.1 KB Created: 2026-05-19 13:53:35 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-19
MD5: 7c4b3aa811378646db10810c4beee10f SHA-1: a7a494d12d93b16f939b3de50412f1b7c5cba979 SHA-256: 570d1153ab3b2f6eee8e386a7302d1695c412660280421877a639a53244ecdcb
6 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://validar.iti.gov.br/ PDF link annotation
    • https://secure.d4sign.com.br/verificarIn PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off00002e22.bin)
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off00002e22.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00074bba.icc pdf-icc-profile PDF ICC profile at offset 0x74BBA 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00002e22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E22 26508 bytes
SHA-256: b6be09389c39fce225504fdba0991b2e95f5fff471a9bbf723d5d55a7f68c5ea
font_01_sfnt_off000065e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65E2 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off000917d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x917D6 11424 bytes
SHA-256: 912193730eced4765bad1b2bbb198f529b36da493fbdb862b200c0f29c3dfdc9
font_03_sfnt_off0009ef2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9EF2D 26420 bytes
SHA-256: 10355fc1f6c1415979bf32d292c89cdca53a84676f2b7375ac0558de069c53b9
font_04_sfnt_off000a361c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA361C 30004 bytes
SHA-256: 65e93a7851203f5ec2b508191587f3979614dc389376d244ad0ea76f934e8db7

Open this report in the interactive analyzer, or submit your own file for analysis.