PDF static analysis report

Static analysis result for SHA-256 847323b3d2f469b8…

SUSPICIOUS

PDF

18.4 KB First seen: 2026-04-06
MD5: 79ebd0a541b4da58caa5b0a23f84fcd6 SHA-1: a93ab5b1bbfbfb3d9be46c79ee8178f9bb7f43ba SHA-256: 847323b3d2f469b81c97a2a9c0ff51086aa9a225bc3a52812af21a11118f85ad
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gul.lods.icu/dls.php?q=Kymco+Mongoose+300+Manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5258008/normal_60b3aacedb46b.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257983/normal_60b3a9b2410d8.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257872/normal_60b3abd22ad9b.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257972/normal_60b3ac4cca921.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258023/normal_60b3ad62ef179.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257937/normal_60b3afa22ccc0.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258023/normal_60b3acbcda87a.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5257966/normal_60b3b0ee665aa.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f6beb9f03.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f68db40bc.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f5db72290.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f5fe73d74.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f8114dc21.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f82232540.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f861da02f.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f840a0d93.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f8515410c.pdfIn extracted file (objstm_0040_00.bin)
    • https://cdn-cms.f-static.net/uploads/5258634/normal_60b3f831133e4.pdfIn extracted file (objstm_0040_00.bin)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0040_00.bin pdf-objstm-decoded PDF /ObjStm 40 0 obj (inflated) 6482 bytes
SHA-256: 42be9ced26f0e6482b722b9e9dbe841e254bcd7139aa1c9891e0176f338c9ba5