PDF static analysis report

Static analysis result for SHA-256 a4f8ca7a31884c60…

SUSPICIOUS

PDF

86.7 KB Created: 2021-12-05 07:48:26 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-07-02
MD5: 659266c8987790481f1911a70a0a3e74 SHA-1: 666753d4d6ab016df29608f16062154110c130c2 SHA-256: a4f8ca7a31884c60f9e37c348f323c43b7a787b66c8c389badd1d9567955f8b0
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0384

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9780764226311&kwd=Arena PDF link annotation
    • https://files8.webydo.com/9588640/UploadedFiles/58D041D8-0803-636E-CC46-2945D8E8739B.pdfIn PDF document text
    • https://static.s123-cdn-static-b.com/uploads/4650138/normal_61ab33b929999.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4658641/normal_61abc8e77a3bb.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4650525/normal_61aaa5a24aa08.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4650191/normal_61ab5bb25ce4d.pdfIn PDF document text
    • https://static.s123-cdn.com/uploads/4649443/normal_61ab4ed53a34c.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/b299884b-e5cb-435a-91b2-4eccc47564cc/the-earth-through-time-9th-edition-203.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0000fe20.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE20 21388 bytes
SHA-256: d19f9dc3b997a7c2ab182f37be59e404b01067132806c9b8873a4ca3a3e2e381
font_01_sfnt_off00012fa3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12FA3 18712 bytes
SHA-256: 629dbe5a79c3d424bbbf42f7d7b7ffdd21a96cac5814b6b77559cfe07d134cbd

Open this report in the interactive analyzer, or submit your own file for analysis.