PDF static analysis report

Static analysis result for SHA-256 9ec037a6b585722e…

CLEAN

PDF

270.3 KB First seen: 2026-05-10
MD5: 4add3e81b66345a6256867896c7752f4 SHA-1: f78f05a1e35d22238a66d927281d9230fa547bac SHA-256: 9ec037a6b585722e251ddcf85955df75c421c443a700b2a2c93e45045863cf44
22 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_4431_00.bin pdf-objstm-decoded PDF /ObjStm 4431 0 obj (inflated) 13540 bytes
SHA-256: 9fff49d35e3f07f0eb95f23e586e733fec322e158c4324ccc88cbe8b02133dcd
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
objstm_0078_00.bin pdf-objstm-decoded PDF /ObjStm 78 0 obj (inflated) 12661 bytes
SHA-256: 73cde50b589e7cda6671babfe6c95a0da4387c6ff0d6111105a1f49bfa0b6f07
objstm_0079_00.bin pdf-objstm-decoded PDF /ObjStm 79 0 obj (inflated) 7331 bytes
SHA-256: fca200750aede830850f8c9ea6f1b1bafa04ed545cd86787c9e94b2b40f71a41
objstm_0080_00.bin pdf-objstm-decoded PDF /ObjStm 80 0 obj (inflated) 13891 bytes
SHA-256: 421658ceba247554f3595485d81a00cd613090fb2e0bcbc893acd4bba1dc09e9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
font_00_cff_off00003af4.bin pdf-font-stream PDF embedded font (cff) at offset 0x3AF4 7965 bytes
SHA-256: 41f3db6612444fd1885fac4328fefc1b37b78ad88354c8756430805c9fb69343
font_01_cff_off000054a1.bin pdf-font-stream PDF embedded font (cff) at offset 0x54A1 6737 bytes
SHA-256: c18f55e7d60096381858d5129b7a3af9ad9fcc2cd279fd40c8fbe0f5466a382e
font_02_cff_off0001b59f.bin pdf-font-stream PDF embedded font (cff) at offset 0x1B59F 4543 bytes
SHA-256: 9e22a1a3bb84fe72ee4ddb30da74ca3ad4254ad9fa30b27b83de09a0dc70d244
font_03_cff_off0001d355.bin pdf-font-stream PDF embedded font (cff) at offset 0x1D355 4174 bytes
SHA-256: 753d73dbb163acb7e14c1c515e63715c55da3f1b5ad472fc7556dfd240de6073

Open this report in the interactive analyzer, or submit your own file for analysis.