PDF static analysis report

Static analysis result for SHA-256 fd34e439382b62ef…

CLEAN

PDF

644.9 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-21
MD5: b07f1be79a409dc0db0b0d41576f76eb SHA-1: d719e251727b3a28d247fa94fb930e4b34e4a64a SHA-256: fd34e439382b62ef438fc4a0995e386014af4a201a7e0bdb7ab91a2138e7edce
24 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 3

  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.net/ PDF link annotation
    • https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.netPDF link annotation
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00056cb7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x56CB7 753738 bytes
SHA-256: cab69d0ac52ba444dabe59db702773d3fc2af50a63ee2eab7bbfbec4fc2eb314
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x0C
icc_00_off0000025b.icc pdf-icc-profile PDF ICC profile at offset 0x25B 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off0008bdf9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BDF9 39120 bytes
SHA-256: b9b0436aae02810f3b80a47511cdf7948e3d1d04bd2b4c1aa611e046d5d816f9
font_01_sfnt_off00091be4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91BE4 26180 bytes
SHA-256: c6de78347b2a5c3976a52479e0fe9a4bb1987009bd91b21324bdb9bd8b26afdf
font_02_sfnt_off00096427.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96427 14752 bytes
SHA-256: 4f43a15c9addd8b749783cdd23bdea118297db0d56fd3f7025fd2c1274c6f61b
font_03_sfnt_off00098d6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98D6D 21472 bytes
SHA-256: 82361f04260e65102b527d5d855deb15f55d8f89e34d1d46cff2b0366d1ec660
font_04_sfnt_off0009c21a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C21A 183608 bytes
SHA-256: f698ceb1dbf94ffc5db2c031eca18e0c6757ab3edd838b19657e81f83f521013
font_05_sfnt_off0009d19c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D19C 39948 bytes
SHA-256: f0fe87d1e8944607f528e482896fdd102706cbbd4878a7cda2ee609508c22868

Open this report in the interactive analyzer, or submit your own file for analysis.