PDF static analysis report

Static analysis result for SHA-256 d7631987052bdf3a…

CLEAN

PDF

1.43 MB Created: 2026-05-18 14:04:37 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-19
MD5: dfe0d1369f561b009c83bd0b622c5e8e SHA-1: 58e1848cfc5e412842b3bf46612b703b949dc97c SHA-256: d7631987052bdf3ac559e243400c869eb4c8ba1b140bc5962c4585b50d9779a6
6 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_00_sfnt_off000021c0.bin)
    • https://www.google.com.br/maps/search/-22.993427469663484PDF link annotation
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • https://learn.microsoft.com/en-us/typography/font-list/calibrihttp://lucasfonts.comMicrosoftIn extracted file (stream_027_off0007045e.bin)
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_027_off0007045e.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_00_sfnt_off000021c0.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_027_off0007045e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7045E 322604 bytes
SHA-256: 952f09ccd9193e4056d6cd38b85993ef679722224b1179fa134264b2fcf8da07
stream_029_off000875c7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x875C7 353300 bytes
SHA-256: 6269f1de0169d3c8b25ae127c69e55142ed2b902a3bee213fca42f834bc23fe2
font_00_sfnt_off000021c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21C0 26972 bytes
SHA-256: 198136cdb93ef0f602b03548cb7118eb7865a0ca75bc2d5b0ecbcb35f2076cb0
font_01_sfnt_off00005ac1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5AC1 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_02_sfnt_off0005fead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FEAD 159032 bytes
SHA-256: eba6a1fd7779c78f88559564088741185a650308b63c6c8478a64598c0062a15

Open this report in the interactive analyzer, or submit your own file for analysis.