PDF static analysis report

Static analysis result for SHA-256 86a88f94a2f67ca1…

CLEAN

PDF

216.9 KB Created: 2009-01-08 17:35:39 +01:00 Authoring application: Writer (via OpenOffice.org 2.2) First seen: 2026-05-09
MD5: d74f587c88a192ed88fcd0daff54527e SHA-1: 8b491b0a7a3b2ab630072d7ebbb4c85bc256ed6f SHA-256: 86a88f94a2f67ca1ecbbfd89a2ddf1a22ba5dbc6195838b10939af3e05f724d2
12 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 3

  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.incoming.pl/ PDF link annotation
    • http://www.buchung.pl/In PDF document text
    • http://www.kurhotel.pl/In PDF document text
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn PDF document text
🗂 Part of campaign: buchung.pl 5 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0000f01b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF01B 14236 bytes
SHA-256: bc34667b2204cb442cb8aff232934ee3a5384b01aaf1fad585e5062ba77ed8df
font_01_sfnt_off000113d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113D1 19372 bytes
SHA-256: 7dd81c5918bbac9313f20040168a2b3ef3d66f08df5df2369cab85bee62b8977
font_02_sfnt_off0001440a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1440A 38788 bytes
SHA-256: 26a819a8af9bcf31b15de2e8f154803efa33c74727f5ecb003fa96bd119f6a16
font_03_sfnt_off00019da9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19DA9 9592 bytes
SHA-256: db43314b82e107ee3998eae43f6ec1a18bc8c8621f01979ab4667c7cedbb40d6
font_04_sfnt_off0001b6cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B6CF 22180 bytes
SHA-256: 12f5974664d3c1b1ccd87b64b36ac2913f165ad3afdab01119ef8b9c65a1f5f8
font_05_sfnt_off0001f352.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F352 17908 bytes
SHA-256: 2a17e9d494f8f7b190bfc4cc11412dae363f69d76a09470d38cf0b67f45f61d3
font_06_sfnt_off00022885.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22885 35340 bytes
SHA-256: 6fb49d83c32eda00f555b49cff890ee063e9a4a271f639582977c7877570b941
font_07_sfnt_off000279e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x279E1 20368 bytes
SHA-256: 377c9cc9e995ad922b6ae75be2cad081ec4287c83bfa0ce0c4a1868e22447f1a
font_08_sfnt_off00029f5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29F5A 1164 bytes
SHA-256: bb467a1c790e72582b417d7fd79ca9f536e5067f5fa6fdc7f620c2d339792a1b

Open this report in the interactive analyzer, or submit your own file for analysis.