PDF static analysis report

Static analysis result for SHA-256 c1592daa9305b59d…

CLEAN

PDF

67.3 KB First seen: 2026-05-15
MD5: 358fac22e557c274a2f79aafd59416c5 SHA-1: 571104cdf8fa0a69af950d12a79fa2c38f1f6ece SHA-256: c1592daa9305b59da20fb660f778a154570939aed4a3f039851c464c597113a4
20 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0011

Heuristics 4

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.acrotex.net/blog/?p=784#comments Referenced by PDF JavaScript
    • http://www.acrotex.net/blog/wp-content/uploads/2012/05/pdfblog_26.pdfReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://www.extensis.com/meta/FontSense/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_055_off000087dc.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x87DC 666 bytes
SHA-256: e76215437fb9420ec078287d5e3aa2ef1debb28c7a52aa467c8ac7fc758a00cb
stream_057_off00008b1f.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8B1F 6018 bytes
SHA-256: 8e548e492c6d60dae94716089295ceb5927234fbbeffabf3ea52fe3e58c4ff68
stream_058_off00009161.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9161 6018 bytes
SHA-256: 4a1414e710d071b5b13b2e41e919c76b3cd9812e804ba6abbcd4c0d46d31cf9a
stream_059_off0000979a.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x979A 5036 bytes
SHA-256: c31cd3c3edc5ad12a2081a01181bd1c11403d660b2b26c76fe883019e17695a6
stream_060_off00009ce2.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9CE2 787 bytes
SHA-256: 3bf1454fb6a01ffdab196b71c28e2d020cb75af30c055665ab71b5199f470b88
stream_061_off00009e40.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9E40 1709 bytes
SHA-256: 26859a27c3e6379e82e4cf93a8383bd6bed0cbf75201365bf0f58e66090b6327
stream_062_off0000a137.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA137 1709 bytes
SHA-256: 9af33b392205fec07fbdebe6f35e8a995faeefc87e0b3b14234f7e53a19c2b39
objstm_0137_00.bin pdf-objstm-decoded PDF /ObjStm 137 0 obj (inflated) 19958 bytes
SHA-256: 2250e00b62937a2547d3d37331c71605c28c1eaa8d416f1b2fad0c7364fabdd5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 long base64-like blob(s).
font_00_cff_off00000cbc.bin pdf-font-stream PDF embedded font (cff) at offset 0xCBC 1078 bytes
SHA-256: dc0e1016c330d1228d5b92394bd689e55229edcd610cdb2bafdf9eb42b31758e
font_01_cff_off000020f2.bin pdf-font-stream PDF embedded font (cff) at offset 0x20F2 1078 bytes
SHA-256: 320d18a22e17180fcd2eb96ba7845ecc7c04a16701e6d65c060f17b55107ec6e
font_04_cff_off0000a75a.bin pdf-font-stream PDF embedded font (cff) at offset 0xA75A 2888 bytes
SHA-256: dfca2bda9fd2994d64d175a0e1630ad54523865d246506e33865f326a43dbe45
font_05_cff_off0000b4ad.bin pdf-font-stream PDF embedded font (cff) at offset 0xB4AD 3391 bytes
SHA-256: 3fe0fac09e97cca010638b2882cdf9dd03ca3c3fe3ab654989f5f7e8b77872fa
font_06_cff_off0000c2a5.bin pdf-font-stream PDF embedded font (cff) at offset 0xC2A5 2072 bytes
SHA-256: a3c97c1920eeceab572d388b4667950cf02f8578f5643b085445314f249411fd
font_07_cff_off0000cbab.bin pdf-font-stream PDF embedded font (cff) at offset 0xCBAB 1702 bytes
SHA-256: f5798d679a26ab578c09a1cd5a00fcc3645583b891d7a01313a9e57bb9804c12
font_08_cff_off0000d3a2.bin pdf-font-stream PDF embedded font (cff) at offset 0xD3A2 1318 bytes
SHA-256: 002a2490348a1ebf3ae8f3ae7da76699c1863902ede231a9d8e0ce12b038dba5

Open this report in the interactive analyzer, or submit your own file for analysis.