PDF static analysis report

Static analysis result for SHA-256 b869e8bfe1852441…

CLEAN

PDF

695.2 KB Created: 2026-05-18 14:20:09 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-19
MD5: 746624b43a3257b7f67234a79c68d295 SHA-1: 3c44dac614eaba73d5635a56c555636cdbd3d3f3 SHA-256: b869e8bfe185244147e71cf08e9cc3767664b4025d7509b5ab1795b383526cd4
6 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off0000292c.bin)
    • http://ocsp.verisign.com0In extracted file (font_05_sfnt_off000a1bb4.bin)
    • https://www.google.com.br/maps/search/-22.91616892771261PDF link annotation
    • https://www.google.com.br/maps/search/-22.916138144721845In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • https://learn.microsoft.com/en-us/typography/font-list/calibrihttp://lucasfonts.comMicrosoftIn extracted file (stream_034_off000780d0.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_034_off000780d0.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off0000292c.bin)
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In extracted file (font_05_sfnt_off000a1bb4.bin)
    • http://crl.verisign.com/tss-ca.crl0In extracted file (font_05_sfnt_off000a1bb4.bin)
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In extracted file (font_05_sfnt_off000a1bb4.bin)
    • http://www.microsoft.com/typographyIn extracted file (font_05_sfnt_off000a1bb4.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_034_off000780d0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x780D0 502384 bytes
SHA-256: dd62cd179b20f3128175feb387a6ba88ef902497edf172d9b717055423b8f389
stream_036_off000a5656.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA5656 26388 bytes
SHA-256: fbf4e7af7809d34cec2081f43c15121b7968fd91b0feca4f268f90865395e42d
font_00_sfnt_off0000292c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x292C 26828 bytes
SHA-256: 97be12374af93691f5d7f4ecad8005009033faa58fadc072b84c2751564ff4a5
font_01_sfnt_off000061c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61C1 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off00063f5b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63F5B 312664 bytes
SHA-256: 8f45c4668e9146ec45c0ada2a651dcb8a185d87663ea5ca693960366939c8a6c
font_03_sfnt_off00074741.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x74741 28948 bytes
SHA-256: ee74c48b4f22c55d039c791dc24b949a04df7986a49f3545c6c60b5a6771370e
font_05_sfnt_off000a1bb4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA1BB4 44052 bytes
SHA-256: 741f07a7e3bfe3abb404a2e683f3c0a5abc9adf5f20929f77999b58ed5137cca

Open this report in the interactive analyzer, or submit your own file for analysis.