PDF static analysis report

Static analysis result for SHA-256 94ce19a8d749a98c…

CLEAN

PDF

3.79 MB Created: 2026-05-18 08:59:55 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-19
MD5: b8b2a8afdc19c3f2594bd8a565beceab SHA-1: d573c80803a04a32361a3f46dba2fad9b16eb623 SHA-256: 94ce19a8d749a98cfa31d1a5f9c44e385e171922be94346a09059d4286e17060
8 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 4

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_01_sfnt_off00007b6a.bin)
    • https://www.google.com.br/maps/search/-23.5926543PDF link annotation
    • https://www.google.com.br/maps/search/-24.0282748In PDF document text
    • https://www.google.com.br/maps/search/-24.0282414In PDF document text
    • https://www.instagram.com/serralheria.pj/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_014_off000045b2.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_014_off000045b2.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_062_off0038c6a5.bin)
    • https://learn.microsoft.com/en-us/typography/font-list/calibrihttp://lucasfonts.comMicrosoftIn extracted file (stream_063_off0039a3bf.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_01_sfnt_off00007b6a.bin)
    • http://www.monotype.com/html/mtname/ms_symbol.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlMicrosoftIn extracted file (font_05_sfnt_off0038a27a.bin)
    • http://www.monotype.com/html/type/license.htmlIn extracted file (font_05_sfnt_off0038a27a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off000045b2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x45B2 19856 bytes
SHA-256: 4cc0e1efedb57c43fcfdfd98b722f2dca7ede05376b4d3ad3e703f892b528350
stream_022_off00011ef7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11EF7 875205 bytes
SHA-256: 8178dd307c82c2dbbccb326bf3ad9b119f6399bec117f94f6b54649783743739
stream_062_off0038c6a5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38C6A5 104344 bytes
SHA-256: eef6796a199258fead806d9273768032978cc330458124cb09fcf83f3699a8a2
stream_063_off0039a3bf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x39A3BF 332112 bytes
SHA-256: 3f88c665fad238c9a2790348cead08600577d9977e1c633f690415f543d0c2f6
font_01_sfnt_off00007b6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B6A 26760 bytes
SHA-256: f76c1c58a62838db99d653a0f21494055100193820946f8dbf6072213210b170
font_02_sfnt_off0000b3cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB3CD 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_03_sfnt_off0000ec5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC5C 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_04_sfnt_off003798e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3798E8 275104 bytes
SHA-256: dbb3c43f820888b40e3a71b7a93f95869c2ba7ce0f3ce7ea972a57a45f85bd9f
font_05_sfnt_off0038a27a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38A27A 11088 bytes
SHA-256: 086b4c456dbe6f09f8c99517bcda6cd0f82646bc0cf77bf0a1e64dd9a7c38fd3
font_08_sfnt_off003b3301.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B3301 79480 bytes
SHA-256: 3950f49b58d9941d5ff79556e0b103152bc2c675a7bc5571973cc5cf1be9caae
font_09_sfnt_off003bd730.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BD730 72936 bytes
SHA-256: 5625c6f0b296f7def5d775b888404492588c6b1108fcc41b2e91318ecb4960d8

Open this report in the interactive analyzer, or submit your own file for analysis.