PDF static analysis report

Static analysis result for SHA-256 cb87322f4fd78d60…

SUSPICIOUS

PDF

18.9 KB First seen: 2026-05-08
MD5: acdbab848ced7927641039b2269665f0 SHA-1: fe944db0e91f6b571b81b78d5464a7ecc5d0a7a9 SHA-256: cb87322f4fd78d60e2a4b03b4a54332cbe76be42cbfe996ea6701d0fbdc4a3b2
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0023

Heuristics 3

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cod.lods.icu/dls.php?q=Kenmore+Elite+45986+Manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/5250602/normal_60afc65d4f381.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250638/normal_60afc59ab0f8d.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250602/normal_60afc5922ab4b.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250638/normal_60afc246c5546.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250738/normal_60afcd350d094.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250748/normal_60afca9d4b3e8.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250690/normal_60afc96e554f8.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5250690/normal_60afc95d8c765.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d3008859c.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d0315678a.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d05311f61.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d311742ed.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d3568ad3c.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d36706bb0.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d388c7706.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d377253b2.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d33428c28.pdfIn extracted file (objstm_0039_00.bin)
    • https://cdn-cms.f-static.net/uploads/5262165/normal_60b5d34575e74.pdfIn extracted file (objstm_0039_00.bin)
🗂 Part of campaign: f-static.net 38 samples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
objstm_0039_00.bin pdf-objstm-decoded PDF /ObjStm 39 0 obj (inflated) 6263 bytes
SHA-256: f563781fef89651ba0dbeeccc669be8a859d5408e579ce6d9739f69de3346274