PDF static analysis report

Static analysis result for SHA-256 efc6aec512963a94…

SUSPICIOUS

PDF

103.0 KB Created: 2024-10-12 19:03:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-25
MD5: aa58212644d72823285903ecb49e705f SHA-1: be8d24f1191c5bcf469cf424b5ce4798e1110624 SHA-256: efc6aec512963a947a5503ba4f7dc61cfebfbd18c8db32751512635e07475261
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 3

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xadagefasox.binonelola.com/57619654708644925287746964116108998?rasugekisowiwomixaxijotagofevurepivelovitodekotawamebiputedameralesidaditabikinetododopaxafezevi=bajajezebasasixijuwanememafawikefevogelomegatokunixesemesosavepanugutaritinitojuwogixudafexidajoxefolotojolegumidozijukaxamonadarepujonomabuxedidufikagupoxilesilibapexikisepumijezovosevapojuzefupojeni&utm_kwd=ford+1210+tractor+manual&fesufosatadurisexadojuwilururupapo=duzilizudojalolenuveramitujarilinisijumutarovatubadedobomevurotikorawexoxawixatoripirinutefuzubeminogolixatidixezirem In PDF document text
    • https://xadagefasox.binonelola.com/57619654708644925287746964116108998?rasugekisowiwomixaxijotagofevurepivelovitodekotawamebiputedameralesidaditabikinetododopaxafezevi=bajajezebasasixijuwanememafawikefevogelomegatokunixesemesosavepanugutaritinitojuwogixudafexidajoxefolotojolegumidozijukaxamonadarepuPDF link annotation
    • https://xadagefasox.binonelola.com/57619654708644925287746964116108998?rasugekisowiwomixaxijotagofevurepivelovitodekotawamebiputedameralesidaditabikinetododopaxafezevi=bajajezebasasixijuwanememafawikefevogelomegatokunixesemesosavepanugutaritinitojuwogixudafexidajoxefolotojolegumidozijukaxamonadarepujonomabuxedidufikagupoxilesilibapexikisepumijezovosevapojuzefupojeni&utm_kwd=ford+1210+tractor+manual&fesufosatadurisexadojuwilururupapo=duzilizudojalolenuveramitujarilinisijumutarovatubadedobomevurotPDF link annotation
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00015581.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00015581.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015581.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15581 11352 bytes
SHA-256: 24229908101bd363d64e349e83247d889f0c14859476ba831b896163cb92a22f
font_01_sfnt_off00017030.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17030 16124 bytes
SHA-256: 2cba7a9ea1976f7cc962dbeae6ce79ebd0121423ac8a791a7793a9a00a37c848

Open this report in the interactive analyzer, or submit your own file for analysis.