PDF static analysis report

Static analysis result for SHA-256 f0c757747893f0ba…

SUSPICIOUS

PDF

92.3 KB Created: 2021-12-06 02:11:08 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-04-05
MD5: 87951c496627a4dce3cc27e67622339e SHA-1: a248bce7dbf2ce55d6aa7c4b754cd86982b8df96 SHA-256: f0c757747893f0baced7d7e0000037ec9a390a8eb921a73af154b38e7948412e
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0241

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9788174368638&kwd=Kites%20Eye%20View%20:%20India%20Between%20Earth%20and%20Sky PDF link annotation
    • https://static.s123-cdn-static-c.com/uploads/4650903/normal_61abdfbb19d13.pdfIn PDF document text
    • https://s3.ap-northeast-1.amazonaws.com/uploads.strikinglycdn.com/files/0922afdd-e499-429c-9bc3-8f7fff452c8b/the-little-angel-a-festive-treat-from-the-sunday-times-bestseller-418.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4658998/normal_61aca5d27504e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4658917/normal_61accd7cdd33a.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/87afc63b-1bf8-48e3-b4a7-e6a5be6175e5/mid-blue-artisan-notebook-flame-tree-journals-.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off0001134a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001134a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1134A 22260 bytes
SHA-256: 83892258961117325e2fa7ed36c4549bddbc81e36cd4aa6293fcce6f433e3d58
font_01_sfnt_off00014726.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14726 18484 bytes
SHA-256: e285036dfc2dee15c64eb6f39e161f0c693453acb0db035853efa8ff6997d0e7

Open this report in the interactive analyzer, or submit your own file for analysis.