PDF static analysis report

Static analysis result for SHA-256 96207827a40c173c…

CLEAN

PDF

472.5 KB Created: 2026-05-15 17:04:40 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-19
MD5: e4ea4202161004bbbed7babbc198d40f SHA-1: 6ed37e44dc746b4f4af116881e2037af93552602 SHA-256: 96207827a40c173ce778e61a14fdb6aab179c26dde212a2755677ca141542a14
6 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • https://serapgroup.com.br/garantias-e-condicoesIn PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off00001eff.bin)
    • https://github.com/JulietaUla/Montserrat)7.200;ULAIn extracted file (font_02_sfnt_off00060ad8.bin)
    • http://www.zkysky.com.ar/ThisIn extracted file (font_02_sfnt_off00060ad8.bin)
    • https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.mdIn extracted file (font_04_sfnt_off00068d19.bin)
    • https://www.google.com.br/maps/search/-26.6289206PDF link annotation
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off00001eff.bin)
    • http://scripts.sil.org/OFLIn extracted file (font_02_sfnt_off00060ad8.bin)
    • https://docs.microsoft.com/typography/aboutWeightWidthOpticalIn extracted file (font_04_sfnt_off00068d19.bin)
    • https://docs.microsoft.com/typography/aboutWeightWidthRegularOpticalIn extracted file (font_05_sfnt_off0006cf95.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_023_off0005ef74.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5EF74 218700 bytes
SHA-256: 63a4a1e354a4328a4c7e3367d06977146e12979f1b439b61cd24e63b9ce6bfb4
font_00_sfnt_off00001eff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EFF 26652 bytes
SHA-256: d0d9bce114432bbae9e47828020f61b774071b7ea71221d96b89e04d764e9920
font_01_sfnt_off00005736.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5736 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off00060ad8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60AD8 25044 bytes
SHA-256: 95052ea7184c893130280758e627ad43b1b1a9ef3d9d7955f46400b869cd6644
font_03_sfnt_off00066ca3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66CA3 22736 bytes
SHA-256: d4bee68fec4d9ea2a2a59d000c89b560104d34a2c6d2e484f235bdf81dca48a5
font_04_sfnt_off00068d19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68D19 32044 bytes
SHA-256: f13240241cbe143971a221a2f791e8935539acde64fc38e1bdaf2ba4fb6350ed
font_05_sfnt_off0006cf95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6CF95 31128 bytes
SHA-256: 72d871eb41d5a92d9bdc6c8f697edfc05f33a145f13a750e124a3249a93476f1

Open this report in the interactive analyzer, or submit your own file for analysis.