PDF static analysis report

Static analysis result for SHA-256 e340aa2786bb609a…

SUSPICIOUS

PDF

54.4 KB Created: 2018-06-11 08:14:30 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2026-06-04
MD5: dd0e7bb813b3cc2af7581b5832853b54 SHA-1: 987af088ee84075507345c389663166b3bc39874 SHA-256: e340aa2786bb609afcf2f3581cbd7674ef74175579f485b5e195f29787b3b9e1
40 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4047

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=taxonomy-crossword-puzzle-answers-biology.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=taxonomy-crossword-puzzle-answers-biology.pdfIn PDF document text
    • https://www.biologyjunction.com/crosswordIn PDF document text
    • http://cabaretveracruz.com/online/taxonomy-crossword-puzzle-answers-biology.pdfIn PDF document text
    • http://masterpdf.org/reads-online/taxonomy-crossword-puzzle-answers-biology.pdfIn PDF document text
    • https://crosswordhobbyist.com/40078In PDF document text
    • http://megama.de/taxonomy/crossword/taxonomy_crossword_puzzle_answers_biology.pdfIn PDF document text
    • https://www.biologycorner.com/lesson-plans/evolution-taxonomy/In PDF document text
    • https://www.biologycorner.com/lesson-plans/In PDF document text
    • http://lanbit.de/taxonomy/crossword/taxonomy_crossword_puzzle_answers_biology.pdfIn PDF document text
    • http://canrei.de/taxonomy/crossword/taxonomy_crossword_puzzle_answers_biology.pdfIn PDF document text
    • http://uncpbisdegree.com/1/zen-doodle-unleashed-freeform-tangle-art-you-can-draw-and-color.pdfIn PDF document text
    • http://uncpbisdegree.com/1/touch-me-not-plant-information.pdfIn PDF document text
    • http://uncpbisdegree.com/1/whatsapp-noka-asha-863.pdfIn PDF document text
    • http://uncpbisdegree.com/1/what-matters-most-finding-spiritual-treasure-in-everyday-life.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-mayo-clinic-healthy-heart-plan.pdfIn PDF document text
    • http://uncpbisdegree.com/1/what-does-political-mean.pdfIn PDF document text
    • http://uncpbisdegree.com/1/writing-comments-on-student-papers.pdfIn PDF document text
    • http://uncpbisdegree.com/1/vz-v6-ute-workshop-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-power-of-a-praying-woman-prayer-and-study-guide-stormie-omartian.pdfIn PDF document text
    • http://uncpbisdegree.com/1/wedding-invitation-cards---designs-with-lord-ganesha.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://www.teacherspayteachers.com/Product/Taxonomy-and-Classification-Crossword-Puzzle-247438In PDF document text
    • https://students.ga.desire2learn.com/d2l/lor/viewer/viewFile.d2lfile/1798/12579/taxonomy15.htmlIn PDF document text
    • https://students.ga.desire2learn.com/d2l/lor/viewer/viewFile.d2lfile/1798/12579/taxonomy_print.htmlIn PDF document text
    • https://students.ga.desire2learn.com/d2l/lor/viewer/viewFile.d2lfile/1798/12579/taxonomy11.htmlIn PDF document text
    • https://www.pinterest.com/pin/500321839828449136/In PDF document text
    • https://wordmint.com/public_puzzles/64041In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://www.teacherspayteachers.com/Product/Taxonomy-andIn PDF document text
    • https://students.ga.desire2learn.com/.../1798/12579/taxonomy15.htmlIn PDF document text
    • https://www.pinterest.com/pin/500321839828449136In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000835c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x835C 15028 bytes
SHA-256: 5873576d258979b67d1f4e8ca348b885aacbe37584ec22a67e9a42a6fac9d576
font_01_sfnt_off0000b0d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB0D5 9500 bytes
SHA-256: 81268e289b0cd161919272dfd7e9a282323a06b70ca704cbaa1eaadd191a86a6