CLEAN
24
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0010
Heuristics 3
-
Unusually high stream count medium PDF_MANY_STREAMSPDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
-
Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTEDPDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.iec.ch In PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_204_off0020e441.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x20E441 | 34940 bytes |
SHA-256: 4e65432277499cba18ad08bb05933187c77cd7d90bf25d06febc00c458c0c6a7 |
|||
icc_00_off001ce3da.icc |
pdf-icc-profile | PDF ICC profile at offset 0x1CE3DA | 3144 bytes |
SHA-256: 2b3aa1645779a9e634744faf9b01e9102b0c9b88fd6deced7934df86b949af7e |
|||
font_00_cff_off00213e4c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x213E4C | 1037 bytes |
SHA-256: 912e32d08e3343bcade234c28603512faf2efe53710af192b06041fee1116956 |
|||
font_01_cff_off00214302.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x214302 | 440 bytes |
SHA-256: 59ef3b7cf4ddd0956394617e17277239c11c8dc7a26d8262df79c8bcd98aa52e |
|||
font_00_cff_off0020880c.bin |
pdf-font-stream | PDF embedded font (cff) at offset 0x20880C | 440 bytes |
SHA-256: f2cc2aeb97a56f36d89395ffbb464446c200d08b7e425a493ff067fe3a1ff490 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.