PDF static analysis report

Static analysis result for SHA-256 584700103a9f435e…

CLEAN

PDF

61.6 KB Created: 2026-02-06 03:33:58 -06:00 Authoring application: Microsoft® Word for Microsoft 365 First seen: 2026-05-16
MD5: a242348d4fffed6a292c2e5f3e0903d9 SHA-1: 286b5b6f0713715910eddf71924f5c3c55f29af9 SHA-256: 584700103a9f435e8b6ed8633360015207bda6cf1b5fae2bedd358b4eeaa91ef
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0131

Heuristics 3

  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://login.paystxacks.info/documents PDF link annotation
    • https://protection.retarus.com/v1?u=https%3A%2F%2Flinkprotect.cudasvc.com%2Furl%3Fa%3Dhttps%253a%252f%252fodlntex.com%252f%26c%3DE%2C1%2C7qrm91fqcP5Lw34g26xAqJjLj7QHQQXwf0yhfeuA02ABxY-LTc1scUnAfXaE7LAkdUmoObSPaVbaTzlk_94BBxQqQbIdvS0s1e1nt0SEHFG2VlBoLloRCYax-rk%2C%26typo%3D1&c=11R4ueinOU&r=6jwoZRDoGFg3kKAMf8it9f&k=7s1&s=m3phWkq5B6pawsZn8y5EUz0IxzaIrtqugG47cnCQoodIn PDF document text
    • https://protection.retarus.com/v1?u=https%3A%2F%2Flinkprotect.cudasvc.com%2Furl%3Fa%3Dhttps%253a%252f%252fplasfocc.com%26c%3DE%2C1%2CGvVjYJEAX2bR0y27FTIrzG7ub3PeCBFy_Cy6fRm_lT4uBhPnfUObFmci83NWymP5Na6AsBNQKKykNH2ZkVb54nuWTbXIRdmbzgGYZO_PpQ%2C%2C%26typo%3D1&c=11R4ueinOU&r=5OSNgpUwyj8O3wfdwXzqHu&k=7s1&s=8Gb4ABqJjTUxDVJty1HYBFOMCwBZhcqx4G4izsKoZxXIn PDF document text
    • https://protection.retarus.com/v1?u=https%3A%2F%2Flinkprotect.cudasvc.com%2Furl%3Fa%3Dhttps%253a%252f%252fsapuraenergys.com%26c%3DE%2C1%2C9iQlUCId-LAIz0y2r5GTWa1ULHqTbufPQ4r6yZAfuIztelUNGpWW-mvbgzM6r5e1FcuGTODCqGfVM_25xb3Lvc7QWbe88L5veNDMyZl4Mz-olMdlSWZHdqSYvBQ%2C%26typo%3D1&c=11R4ueinOU&r=3fSVh3rXdDddb0n6rZIH8Y&k=7s1&s=jdx6JtC1UXlcoaSCCru588iP4tPDwB1hRsQokqe14AKIn PDF document text
    • https://us.link-protection.cymail.io/api/v2/url?u=v3.D5MAAICqqqrq%2F3T0k%2FnJ1F13M3UAhzi4eUT4CuEe5h5hcQnQ1c3DzcIsTNV8iVAugHIZQusn43F1%2Fr20XROsDiPdG%2BmveqSbetx31ZOcliG0PiIywi7C7mZ9aJsueOuDDHakmzrCbqin8xjFCcw%2FpSrPM2fzZ7NeZvUVzzAsHD%2Fudt29pfBnUZVkW28O32K7X%2BX9y%2F9lk%2BnlHB1Cucr84TVgJSBZcfHRFZs9Y%2Bj4VXOU7yv2eC8KUv%2BdeHMs%2Btt9%2FbbI6CmOh%2BHRNlM0SLEwFHIIUq4koMI4IBJlQZpYYRB3xGk7SFhCIDQpsEgrQCFVQBieACmZY4yJRCkxoMIYjJlzTAoiERk%3DIn PDF document text
    • https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.mdIn extracted file (font_00_sfnt_off0000aeec.bin)
    • https://linkprotect.cudasvc.com/url?a=https%3A%2F%2Fthefuturelaboratorys.com%2F&c=E,1,GZ996szEwcFOjfXWdISj0QgRy3VycX4r0GLiS6c9HIWjltD2DkUvDLDSi_VJmSqxEWTI3xyqe2ZJyXg2rrdqXhlDZLkF3UY27yDblcbLIw,,&typo=1In PDF document text
    • https://linkprotect.cudasvc.com/url?a=https%3A%2F%2Fpgconsa.com%2Fsom%2F&c=E,1,cji6wXAvYQ5BfIDinPxRCSpIgtVxBtLoNZbqniYnqlMKj1cJnA07s7NV-_3wKnczFz4sq4QMe69rY1dCUCiWI17FSqf4aueTMyLM5m7GtGEX6pRH2nRoJ0BJ&typo=1In PDF document text
    • https://scanner.topsec.com/?d=3704&r=auto&u=https%3A%2F%2Flinkprotect.cudasvc.com%2Furl%3Fa%3Dhttps%253a%252f%252fdalsingroup.com%252fassets%252f%26c%3DE%2C1%2CQBt_0LiSu_kBsgfi9tZtsL7zpQW_SNd91dvrbkMracQ7nEiTXnutgBXBn7YxhZreG3AxSwVnu6RY3r5zbVubTqdmG93vmxb_3TegefYYaaA%2C%26typo%3D1&t=799160c0c2c1022cf3ce9749788c7cfb5830d6b2In PDF document text
    • http://5l0p.3utilities.com/In PDF document text
    • https://linkprotect.cudasvc.com/url?a=https%3A%2F%2Fdevinternational.org%2Fimages%2F&c=E,1,vS-BvwcaFehLv8uAc9rvkEb4Epi31pEJGFe-0CvORaRiVtEIaPJA1fNk8SdJm5irpx53tGt1qXcZoK5BVhifhDWYnFW2g7JVUzfendWUcA,,&typo=1In PDF document text
    • https://linkprotect.cudasvc.com/url?a=https%3A%2F%2Fyaldram.com%2Ffonts%2F&c=E,1,fT8tmbyTdy5WoXVsh82UAZwBEt1wC9XaYntfBl1VaH_rQn8_FrjDfge1ArqLo-qOCHRM3tY9QtSTlgMafmV79H-4CnBMpM8uwphoLZ864g,,&typo=1In PDF document text
    • http://st089.3utilities.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://docs.microsoft.com/typography/aboutWeightWidthRegularOpticalIn extracted file (font_00_sfnt_off0000aeec.bin)
    • https://docs.microsoft.com/typography/aboutWeightWidthOpticalIn extracted file (font_01_sfnt_off0000d3b5.bin)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aeec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAEEC 23064 bytes
SHA-256: 3785766f37e7c4cb133bc2015d4afaf19db8b088f68ffbc70ae1fa9db7d97c14
font_01_sfnt_off0000d3b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3B5 19840 bytes
SHA-256: 89cb78b72afd79e8f860ff65c02ae7c7636a57ca8ac472a8f1d90be82d6b968a

Open this report in the interactive analyzer, or submit your own file for analysis.