PDF static analysis report

Static analysis result for SHA-256 b7233079b6a7922b…

CLEAN

PDF

218.3 KB Created: 2009-01-08 18:04:31 +01:00 Authoring application: Writer (via OpenOffice.org 2.2) First seen: 2026-05-10
MD5: 64136e8467fde4201aa09e04d8954683 SHA-1: 6e99cccd59eec0fcf6d531331dee1786a37f55f1 SHA-256: b7233079b6a7922b5865ed742f06ba3a51eaf763494e29e1b18bc66ac94c96f0
12 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0007

Heuristics 3

  • AcroForm button with action trigger low PDF_ACROFORM_BUTTON
    PDF contains a /Btn form field together with a SubmitForm/URI/Launch/JS trigger — this is the building block of fake 'Download' or 'Open' button overlays used in PDF phishing lures
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.incoming.pl/ PDF link annotation
    • http://www.buchung.pl/In PDF document text
    • http://www.kurhotel.pl/In PDF document text
    • http://www.monotype.comhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlNOTIFICATIONIn PDF document text
🗂 Part of campaign: buchung.pl 5 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00022635.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x22635 14236 bytes
SHA-256: bc34667b2204cb442cb8aff232934ee3a5384b01aaf1fad585e5062ba77ed8df
font_00_sfnt_off000249eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x249EB 20108 bytes
SHA-256: ecb3bf867e19228a4da163e73d326c0bd7f83a9f485023610d90655c7389f417
font_01_sfnt_off00026e9c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26E9C 17216 bytes
SHA-256: 023cfbf8ac7336ebb1f17150e13de5230a7b4ddab645e4d2d875f835ef1e7ff4
font_02_sfnt_off0002a0ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A0EF 18672 bytes
SHA-256: ee407f4181199c6ca4716d081c91cd1a540798964df9e3081cbfcf3caeafa11d
font_03_sfnt_off0002cf4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CF4A 21708 bytes
SHA-256: fa3acc3d5e421eb1f981aaf883332400a11421da0cae3eeca376e60f08d1ba99

Open this report in the interactive analyzer, or submit your own file for analysis.