PDF static analysis report

Static analysis result for SHA-256 833971f677d16fba…

SUSPICIOUS

PDF

65.6 KB Created: 2018-06-11 08:26:09 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-05-09
MD5: f2badf4a9f0e41391b8d1afc20111848 SHA-1: 9c3c86db1c54ffcbe64cfbc72c18c5dc63706d42 SHA-256: 833971f677d16fbafbf111c57b9149fca4eb3063895bf497360471df191ef7ff
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0407

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-mummy-case-jim-knighthorse-book-2.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=the-mummy-case-jim-knighthorse-book-2.pdfIn PDF document text
    • http://sonorasda.com/reads-online/the-mummy-case-jim-knighthorse-book-2.pdfIn PDF document text
    • http://animeostku.com/reads-online/the-mummy-case-jim-knighthorse-book-2.pdfIn PDF document text
    • http://infoda.de/the/mummy/the_mummy_case_jim_knighthorse_2_jr_rain.pdfIn PDF document text
    • http://riverside-resort.net/1/start-up-and-stay-up-in-thailand.pdfIn PDF document text
    • http://riverside-resort.net/1/storytown-3rd-grade-around-the-world.pdfIn PDF document text
    • http://riverside-resort.net/1/short-term-financial-management-3rd-edition-solution.pdfIn PDF document text
    • http://riverside-resort.net/1/tom-swift-collection-volume-two-five-novels-in-one-volume.pdfIn PDF document text
    • http://riverside-resort.net/1/the-birthday-of-world-and-other-stories-ursula-k-le-guin.pdfIn PDF document text
    • http://riverside-resort.net/1/speed-queen-sfg709-dryers-owners-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/shakespeare-apos-s-as-you-like-it.pdfIn PDF document text
    • http://riverside-resort.net/1/spin-a-soft-black-song-poems-for-children.pdfIn PDF document text
    • http://riverside-resort.net/1/study-in-sri-lanka-undergraduate.pdfIn PDF document text
    • http://riverside-resort.net/1/the-outlaw-trail-a-history-of-butch-cassidy-and-his-wild-bunch.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://www.amazon.com/Mummy-Case-Jim-Knighthorse-Book-ebook/dp/B0040GJ948In PDF document text
    • https://www.amazon.com/books-used-books-textbooks/b?ie=UTF8&node=283155In PDF document text
    • https://www.amazon.com/Mystery-Thrillers-Books/b?ie=UTF8&node=18In PDF document text
    • https://www.amazon.com/Mystery-Thrillers-Books/b?ie=UTF8&node=10457In PDF document text
    • https://www.amazon.com/Mummy-Case-Jim-Knighthorse-Book-ebook/product-reviews/B0040GJ948In PDF document text
    • https://www.goodreads.com/book/show/8442145-the-mummy-caseIn PDF document text
    • https://www.fantasticfiction.com/r/j-r-rain/mummy-case.htmIn PDF document text
    • https://www.amazon.com.au/Mummy-Case-Jim-Knighthorse-Book-ebook/dp/B0040GJ948In PDF document text
    • http://www.dailymotion.com/video/x36wwzpIn PDF document text
    • https://www.amazon.co.uk/Mummy-Case-Jim-Knighthorse-Book/dp/B00AEAVEF6In PDF document text
    • https://www.amazon.co.uk/Mummy-Case-Jim-Knighthorse-Book-ebook/dp/B0040GJ948In PDF document text
    • https://www.amazon.co.uk/crime-thrillers-mystery-books-eBooks-kindle/b?ie=UTF8&node=362247031In PDF document text
    • https://www.amazon.co.uk/mystery-crime-thrillers-ebooks-kindle/b?ie=UTF8&node=362248031In PDF document text
    • https://0.r.bat.bing.com/?ld=d3xCWo5lK9Ap62m2_bdtvAHjVUCUww_7wS-jcJlXwFNwYduYvn5QNFioMM9y8pe_okixufWvnKcmDdJPg0EFpR6hoDDqcHZaC9YZBvHlVu4T6qfxb1L0vbUcJ1Fh1_sNgJMqlcANk7TTYco-aSIeVkW5J2TBZAbgyqvWX1jwTBjVW3IGno&u=http%3a%2f%2fwww.amazon.com%2fs%2f%3fie%3dUTF8%26keywords%3djim%2bknighthorse%26tag%3dmh0b-20%26index%3ddigital-text%26hvadid%3d1470722942%26hvqmt%3dp%26hvbmt%3dbp%26hvdev%3dc%26ref%3dpd_sl_5kk9o1t2zj_pIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://www.amazon.com/Mummy-Case-Jim-Knighthorse-Book-ebook/In PDF document text
    • https://www.amazon.com.au/Mummy-Case-Jim-Knighthorse-Book-ebook/dp/In PDF document text
    • https://1138.r.bat.bing.com/?ld=d3l_rcZTx8-0ZL8YdLbdgXBTVUCUxQZCBagHLkX-_7X_a_zu1X8APF2SPGIhkraMfvpmxxDGKfpOkzPvR1veNfTPdLl4eiFGl0mEVPOjbGJ_0R5DL0NNzUXripZ42iKfhITTexW3HlH3xZWICTppAdHvH7NWLcnS9vhc9cTiuCqqzhvAWX&u=http%3a%2f%2fclickserve.dartsearch.net%2flink%2fclick%3flid%3d92700028756917700%26ds_s_kwgid%3d58700003659232763%26ds_e_adid%3d8806820489%26ds_s_inventory_feed_id%3d97700000002834197%26ds_e_product_group_id%3d1100200047484%26ds_e_product_id%3dB00A9Z1P9Q%26ds_e_product_country%3dUS%26ds_e_product_language%3dEN%26ds_e_product_channel%3donline%26ds_url_v%3d2%26ds_dest_url%3dhttps%3a%2f%2fwww.audible.com%2flp%2ftitle%2f%3fasin%3dB00A9Z1P9Q%26source_code%3dMSNGBWS0929169043%26mkwid%3dstHKiLtZx_dc%26pcrid%3d8806820489%26pmt%3dbroad%26pkw%3dPLA%26msclkid%3d%7bmsclkid%7dIn PDF document text
    • https://1138.r.bat.bing.com/?ld=d30rM-ponIf2p2WiFV4bnQazVUCUy_0oE-pg0v7NjpefvYjZ3a5lzYZnwZgQdo8K-qZdOTcAZeYnZyrxKZsgY-IdAWdH3jCBexRX_VJGc-_Vu2q6MFk2mZxZTwGjKV1i4ts3YEKr4Jm1iZpsHdUQXyQwgEFV7IUAa2rIsxRYK2diZkHdui&u=http%3a%2f%2fclickserve.dartsearch.net%2flink%2fclick%3flid%3d92700028758603586%26ds_s_kwgid%3d58700003659411941%26ds_s_inventory_feed_id%3d97700000002834197%26%26ds_e_adid%3d13026748972%26ds_e_product_group_id%3d4580428002701636%26ds_e_product_id%3dB00CLH1J0A%26ds_e_product_country%3dUS%26ds_e_product_language%3dEN%26ds_e_product_channel%3donline%26ds_url_v%3d2%26ds_dest_url%3dhttps%3a%2f%2fwww.audible.com%2flp%2ftitle%2f%3fasin%3dB00CLH1J0A%26source_code%3dMSNGBWS0929169043%26cvosrc%3dppc.bing.%26cvo_campaign%3d44171123%26cvo_crid%3d13026748972%26Matchtype%3de%26msclkid%3d%7bmsclkid%7dIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ab8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB8E 14716 bytes
SHA-256: 6733947d1f67f9c11592544bd2c05bf712758ffa5d77124485fcd15230da8ee1
font_01_sfnt_off0000d8d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8D0 11260 bytes
SHA-256: 6b0c27b52e9a2fb7ee1a1e5e686fd8c3f2605313b0a27c2a42b78e7c9cfbf7ed