PDF static analysis report

Static analysis result for SHA-256 5fe2ac9ffef6406e…

CLEAN

PDF

1.07 MB Created: 2026-05-12 05:43:00 +02:00 Authoring application: Microsoft® PowerPoint® 2019 First seen: 2026-05-22
MD5: 224aa8ba4884a9a5688239d444b6ee6f SHA-1: 5822a68eb4091114b5a7d80581b36675e7657e5c SHA-256: 5fe2ac9ffef6406e1ae62b5a85830fe8dab289102e9025e71e32e402090d6d12
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.linotype.com/fontdesignersNOTIFICATION In extracted file (font_00_sfnt_off000bc573.bin)
    • http://www.linotype.com/licenseHelveticaNeueLTIn extracted file (font_00_sfnt_off000bc573.bin)
    • http://ocsp.thawte.com0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://ts-ocsp.ws.symantec.com07In extracted file (font_00_sfnt_off000bc573.bin)
    • http://ocsp.verisign.com01In extracted file (font_00_sfnt_off000bc573.bin)
    • http://ocsp.verisign.com0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://www.linotype.com0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • https://learn.microsoft.com/en-us/typography/font-list/calibrihttp://lucasfonts.comMicrosoftIn extracted file (stream_033_off000d4cba.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_033_off000d4cba.bin)
    • http://crl.thawte.com/ThawteTimestampingCA.crl0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://ts-aia.ws.symantec.com/tss-ca-g2.cer0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(In extracted file (font_00_sfnt_off000bc573.bin)
    • https://www.verisign.com/rpaIn extracted file (font_00_sfnt_off000bc573.bin)
    • https://www.verisign.com/cps0*In extracted file (font_00_sfnt_off000bc573.bin)
    • https://www.verisign.com/rpa0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://logo.verisign.com/vslogo.gif0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://crl.verisign.com/pca3.crl0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn extracted file (font_00_sfnt_off000bc573.bin)
    • http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In extracted file (font_00_sfnt_off000bc573.bin)
    • http://www.microsoft.com/truetype/fonts/wingdings/MicrosoftIn extracted file (font_06_sfnt_off0010c8c8.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off00087d4f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x87D4F 81771 bytes
SHA-256: 5d00db1c07cfe02daaa23b18c526b9aad6fbb0d407aea47eeef5bca0348778a6
stream_033_off000d4cba.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD4CBA 346552 bytes
SHA-256: 8260e3c351aa18ada176e1e9f7ad5bdc8c2137036e1b88c1790d838de096dfa7
stream_034_off000ef25f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEF25F 320320 bytes
SHA-256: 353c6c9e7203244c68183272106f5c1cfa7ceca10cb692c6d52ef353dd4af3f7
font_00_sfnt_off000bc573.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC573 53404 bytes
SHA-256: 452ac516ce306d831188ed4e22434276ae3299332b9265a805ce6a8f58e75817
font_01_sfnt_off000c2636.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2636 78312 bytes
SHA-256: 8fab94b4176e5a629db8c6e79f2a6331a3fe03d47dd41c14fbb94e854416cb6d
font_02_sfnt_off000cb476.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCB476 80064 bytes
SHA-256: e234228cdce506735cb883ae37ce942f597def8c75247a2ba3274de438e10292
font_05_sfnt_off00105b01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105B01 63604 bytes
SHA-256: 4a09f6e38a4979666d88e7366d8e7684874db46b4216e1496fb001ba64476f6c
font_06_sfnt_off0010c8c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C8C8 14180 bytes
SHA-256: ea845d0e384984a0e8aa4393bad66e7315b15e1268ef7990f53ffe81b10f0cb6

Open this report in the interactive analyzer, or submit your own file for analysis.