PDF static analysis report

Static analysis result for SHA-256 e42460eb022fb6e1…

SUSPICIOUS

PDF

58.0 KB Created: 2011-07-04 09:42:03 +02:00 Authoring application: 376377000P000D000F000C000r000e000a000t000o000r000 000V000e000r000s000i000o000n000 0000000.0009000.0003 (via GPL Ghostscript 8.54) First seen: 2026-05-14
MD5: 641bd733778db4ad8ec7b43ba48f70aa SHA-1: 7ce41074645d69ecbb070f101340b1292f7c3f78 SHA-256: e42460eb022fb6e15cda04784573f5a5cb19d4ba79627768ed0194e3291ca8a3
42 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://justlottery.com/all-results/South-Africa-Lotto.html In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.