PDF static analysis report

Static analysis result for SHA-256 f1694ea9eeb316a7…

SUSPICIOUS

PDF

94.7 KB Created: 2021-12-10 21:23:48 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2023-12-08
MD5: da3fb5c8818bfa21fefe5d6369c12d4c SHA-1: 3a74c757616c7e247339c3ff826e49423fa88746 SHA-256: f1694ea9eeb316a73d8f7bfcb4047063983104fd6af162081c394ec878e6718c
59 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0233

Heuristics 4

  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9780415261852&kwd=The%20Origins%20of%20the%20First%20World%20War PDF link annotation
    • https://static.s123-cdn-static-a.com/uploads/4660550/normal_61b197f9a28cc.pdfIn PDF document text
    • https://static.s123-cdn-static-c.com/uploads/4660261/normal_61b122f96c167.pdfIn PDF document text
    • https://s3.ap-northeast-1.amazonaws.com/uploads.strikinglycdn.com/files/2113abf6-6be0-43d2-80f7-9462e08d741e/r-3.pdfIn PDF document text
    • https://files8.webydo.com/9589274/UploadedFiles/23E13466-67DF-0BFE-5221-B89E025C6830.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4662575/normal_61b269d44c370.pdfIn PDF document text
    • https://img1.wsimg.com/blobby/go/47f7d07d-c4c1-4f8d-bda4-1ecd4b276b77/sensualitiestextualities-and-technologies-writ.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_007_off000118ec.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off000118ec.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x118EC 21972 bytes
SHA-256: ca9356e0fdbe65771c44bb6f08cbb34309171462c2c3178aa6ce19b815b71e1e
font_01_sfnt_off00014c03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C03 19968 bytes
SHA-256: d81eb119173fd6046dbc470cac2df01c21b1fffca79d126b4d55962ef62da2da

Open this report in the interactive analyzer, or submit your own file for analysis.