PDF static analysis report

Static analysis result for SHA-256 bcc19961f995d574…

SUSPICIOUS

PDF

151.9 KB Created: 2021-12-12 09:09:15 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-02
MD5: f66c3be63f924fb3d04aa953553afdf8 SHA-1: 900db97db2fdfe9cb0b1372f9298479289bfb9f9 SHA-256: bcc19961f995d57420b9938e6fdb3a6ac79bbe6da9163a7ee44fb7b37793a8ae
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0031

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=&isbn=9789029573863&lng=nl&kwd=Het%20Mysterie%20Van%20Het%20Bewustzijn PDF link annotation
    • http://getpdf.pw/book?res=weby&isbn=9789029573863&lng=nl&kwd=Het%20Mysterie%20Van%20Het%20BewustzijnIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4673305/normal_61b50f2a9e5f9.pdfIn PDF document text
    • https://static.s123-cdn-static-b.com/uploads/4674633/normal_61b4b28074236.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4665705/normal_61b3c0a0e24c2.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4666189/normal_61b41367d08ba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4666929/normal_61b485b23fe38.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4665580/normal_61b3c0cebadca.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4673134/normal_61b509c6c8526.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0001fa4d.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001fa4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FA4D 24204 bytes
SHA-256: a08c35a5ac6fad6144be0b86e665febe12668fd173c88a43180a60342cdb52e4
font_01_sfnt_off000230a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x230A3 18924 bytes
SHA-256: def26971eb50d6388b4c3f728f4cf6cfe6a6522edccd3a39a305e6388cc97896

Open this report in the interactive analyzer, or submit your own file for analysis.