PDF static analysis report

Static analysis result for SHA-256 8333f7126065fc97…

SUSPICIOUS

PDF

60.0 KB Created: 2018-06-11 08:31:05 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-05-08
MD5: 5b880e7ce2183761b5597ed32b418d7f SHA-1: 833073daf2405e3c765817a185f1d8321637cd07 SHA-256: 8333f7126065fc97c66154b8d558f1ddcb34b9aa9472d82d3f6109f8b4cf2f44
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0447

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=worldwide-general-knowledge-questions-answers-urdu.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=worldwide-general-knowledge-questions-answers-urdu.pdfIn PDF document text
    • http://armide.de/worldwide/general/worldwide_general_knowledge_questions_answers_urdu.pdfIn PDF document text
    • http://www.managementinformationsystems.org/reads-online/worldwide-general-knowledge-questions-answers-urdu.pdfIn PDF document text
    • http://thanil.de/worldwide/general/worldwide_general_knowledge_questions_answers_urdu.pdfIn PDF document text
    • http://dentistabrugherio.com/file/worldwide-general-knowledge-questions-answers-urdu.pdfIn PDF document text
    • http://insiderloot.com/reads-online/worldwide-general-knowledge-questions-answers-urdu.pdfIn PDF document text
    • https://gotest.pk/general-knowledge/world/online-test-4-mcqs-for-preparation-practice-quiz/In PDF document text
    • https://gotest.pk/category/general-knowledge/In PDF document text
    • https://gotest.pk/category/general-knowledge/world/In PDF document text
    • http://go4quiz.com/29/general-knowledge-pakistan-quiz-questions/In PDF document text
    • https://gotest.pk/islamic-info-general-knowledge-quiz-online/In PDF document text
    • http://www.knowledgepublisher.com/article-424.htmlIn PDF document text
    • http://www.knowledgepublisher.com/category-9.htmlIn PDF document text
    • http://www.itdunya.com/showthread.php?517746-500-General-Knowledge-Facts-in-Urdu-PDF-BookIn PDF document text
    • http://riverside-resort.net/1/sony-walkman-nwz-e464-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/top-100-praise-and-worship-guitar-songbook-volume-2-paperback.pdfIn PDF document text
    • http://riverside-resort.net/1/timoshenko-strength-of-materials-solution-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/southbend-171d-owners-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/the-mentor-leader-secrets-to-building-people-and-teams-that-win-consistently-tony-dungy.pdfIn PDF document text
    • http://riverside-resort.net/1/teacher-apos-s-survival-guide-gifted-educ.pdfIn PDF document text
    • http://riverside-resort.net/1/the-time-bind-when-work-becomes-home-and-home-becomes-work.pdfIn PDF document text
    • http://riverside-resort.net/1/toilet-paper-entrepreneur.pdfIn PDF document text
    • http://riverside-resort.net/1/sharp-notevision-xr-10x-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/solution-of-quantitative-business-by-erson-10-edition.pdfIn PDF document text
    • https://gotest.pk/islamic-info-general-knowledge-quiz-onlineIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://www.youtube.com/watch?v=JC2meNQPS_IIn PDF document text
    • https://www.youtube.com/watch?v=eJ-LSlwVuQcIn PDF document text
    • http://www.academia.edu/8412902/General_Knowledge_365_Useful_General_Information_in_UrduIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000973f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x973F 14928 bytes
SHA-256: f9473eea149b3ab9f55f4fe54fe619840854d84c54dc80a2db66d815b0acd8c8
font_01_sfnt_off0000c4ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC4EE 10388 bytes
SHA-256: aeac1677de3f028f7d1ee321356fd1d4fe3957c4d6cf1dbd7b84c46830b9ba77