PDF static analysis report

Static analysis result for SHA-256 e008be11238706e2…

CLEAN

PDF

87.7 KB First seen: 2026-05-10
MD5: 9d06febd6224edfe2871f48d8b7b4105 SHA-1: 0833e8d88cc36edf1461780f4b971a099557cb1f SHA-256: e008be11238706e2e58dd90e33f6f0e4a49005b890dbb7e2de508c8d29154b2a
22 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0019

Heuristics 5

  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.acrotex.net/blog/?p=784#comments Referenced by PDF JavaScript
    • http://www.acrotex.net/blog/wp-content/uploads/2012/05/pdfblog_26.pdfReferenced by PDF JavaScript
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/AcrobatAdhocWorkflow/1.0/In PDF document text
    • http://www.extensis.com/meta/FontSense/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 18

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off000018fa.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18FA 2872 bytes
SHA-256: e2d28ee8bf3b88a907b4f2b96387135605e4db32b96cc09b0c1597c50666b551
stream_085_off0000d262.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD262 1794 bytes
SHA-256: 9a350c6cf2e7f339565ecc5add670a23b263408e7a3a9166495866520c50bded
stream_086_off0000d572.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD572 1794 bytes
SHA-256: c7f1818ee53c6b744aea98d313e58a343c26cdd167692a83757f564d3cd33640
stream_091_off0000dbfa.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDBFA 1367 bytes
SHA-256: 02a133a2c74b2781a480b330a8d73230449253f21ef3d4f46290d4f43c7943cd
stream_095_off0000e29f.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE29F 6018 bytes
SHA-256: 8e548e492c6d60dae94716089295ceb5927234fbbeffabf3ea52fe3e58c4ff68
stream_096_off0000e8e1.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE8E1 6018 bytes
SHA-256: 4a1414e710d071b5b13b2e41e919c76b3cd9812e804ba6abbcd4c0d46d31cf9a
objstm_0357_00.bin pdf-objstm-decoded PDF /ObjStm 357 0 obj (inflated) 20965 bytes
SHA-256: 811db4791f5b7b2f5bee2075116e8893de07ed8f3118b66cad677fe2435d1fa1
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
font_00_cff_off00005a6b.bin pdf-font-stream PDF embedded font (cff) at offset 0x5A6B 1586 bytes
SHA-256: 4ba1b5a516098c022e5c416bdae09b9b3f4855c635bfc44a46f63e4e53421745
font_01_cff_off0000628d.bin pdf-font-stream PDF embedded font (cff) at offset 0x628D 1208 bytes
SHA-256: 7c03ce66c855c5f588579d34d9afbc4dc0323c725c4fb66fb4ad5ae11511f26c
font_02_cff_off000078d7.bin pdf-font-stream PDF embedded font (cff) at offset 0x78D7 996 bytes
SHA-256: 188c8a1d86129514272bd2eeaac861d3f698078733dd1d17a276c00f1086de6b
font_03_cff_off0000ab01.bin pdf-font-stream PDF embedded font (cff) at offset 0xAB01 1062 bytes
SHA-256: d1e83540a0160b13b8f5370622a027dec6399ece4fb64e95fa40fdf637803119
font_04_cff_off0000ef27.bin pdf-font-stream PDF embedded font (cff) at offset 0xEF27 3009 bytes
SHA-256: 53af0dd69502e341acf0ea6668e0e58c12455232385b75dc512cfbcc47e628dc
font_05_cff_off0000fbca.bin pdf-font-stream PDF embedded font (cff) at offset 0xFBCA 992 bytes
SHA-256: 164b1f11f90687a7c5daa24b7f7bd713a6398200386dfb959c181681c1a9444c
font_06_cff_off00010102.bin pdf-font-stream PDF embedded font (cff) at offset 0x10102 1907 bytes
SHA-256: 0081e379b407a8feffa8072376b0116b3d30b99f543a49fc20dc01c9b0e2056c
font_07_cff_off0001099e.bin pdf-font-stream PDF embedded font (cff) at offset 0x1099E 2072 bytes
SHA-256: 0586f5f91e5d3cf4effb3fa410a7aaa8366300895986064d79b4c846a6cc629d
font_08_cff_off000112b3.bin pdf-font-stream PDF embedded font (cff) at offset 0x112B3 3015 bytes
SHA-256: 2f7747a2e130a4e19fbe6db2ee32d8a9feb3c343ad2e5ca5749f4007a14e5ae1
font_09_cff_off00011f4c.bin pdf-font-stream PDF embedded font (cff) at offset 0x11F4C 1702 bytes
SHA-256: f75d3881545a69484d0d860dd3193e8c2c7a8ac3f15d39b91ae75655e3cfbcb8
font_10_cff_off00012754.bin pdf-font-stream PDF embedded font (cff) at offset 0x12754 1631 bytes
SHA-256: a2043f7e7c3276c07557b38b58b7c8876a8a6104636654c01cb9ddec9cd47482

Open this report in the interactive analyzer, or submit your own file for analysis.