PDF static analysis report

Static analysis result for SHA-256 ff4e2c4861c16f61…

CLEAN

PDF

153.8 KB Created: 2010-05-16 20:18:43 -04:00 Authoring application: TeX (via pdfTeX-1.40.9) First seen: 2015-09-14
MD5: 21470378b6fe5b5a2633274b55270f34 SHA-1: 468eeb44228653b623024080836d85a99e41d480 SHA-256: ff4e2c4861c16f61b29fed19b04ec7d741fbfb0fa76ad137b4cc6c131a206493
4 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 2

  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cl.uni-heidelberg.de/trac/ In PDF document text
    • http://pfaedit.sf.net/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 16

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off00011135.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11135 2326 bytes
SHA-256: d1906d0ce18ce92af2b91b5b3e4344179e0102a90141b863025207b1f96764ec
stream_017_off00011aa3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11AA3 2138 bytes
SHA-256: fe375e270f70de99de30589e38b1a65ee7cb851ddbeca188f94eb717eedcc644
stream_026_off00019a3e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19A3E 15024 bytes
SHA-256: e6320d9de22c7e9573eea94aaf5513cc0647cb3b5aa32907093d20c47cf388fc
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.92, consistent with packed or encrypted content.
stream_027_off0001d3d1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D3D1 19820 bytes
SHA-256: 02a54407bc1c8845f88d09c3d7b884c793343254fbf51e004e262ab574f5d181
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.95, consistent with packed or encrypted content.
icc_00_off000062b4.icc pdf-icc-profile PDF ICC profile at offset 0x62B4 1456 bytes
SHA-256: 2a18161bb96fd584d19e737ce294732789e0e8e6ae8c8e4e5f09f1b138232a63
icc_01_off00006636.icc pdf-icc-profile PDF ICC profile at offset 0x6636 1296 bytes
SHA-256: 94722fe267764797f8887379cc0d355f5118beb3d186e087bfbd9e1a3f2d3f49
font_00_sfnt_off00006fc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6FC7 7416 bytes
SHA-256: c85c00e2deddfb5ba7e6abbfa3dc2c0bee95abec4c9d75cec34276d06fa0f31a
font_03_type1_off0001235e.bin pdf-font-stream PDF embedded font (type1) at offset 0x1235E 1935 bytes
SHA-256: dda14f0799b4e773e3d99dc971be94f6a3e9565aeee882c9011836f3cd5387e7
font_04_type1_off00012b53.bin pdf-font-stream PDF embedded font (type1) at offset 0x12B53 1787 bytes
SHA-256: df1889e5c1fab81d4ca147a4b67dfe3a66b59de567bc17918c843f09b292cf30
font_05_type1_off000132ae.bin pdf-font-stream PDF embedded font (type1) at offset 0x132AE 1788 bytes
SHA-256: 2b741fc5f96927f717fe5e87af6cfebe8daa62f40b16a7f007730a0098dd00f3
font_06_type1_off00013a06.bin pdf-font-stream PDF embedded font (type1) at offset 0x13A06 1785 bytes
SHA-256: 3e3dbb9eb11fd565a4c923407515a072de063ec19c689072783f3dc3a08b9d18
font_07_type1_off0001415b.bin pdf-font-stream PDF embedded font (type1) at offset 0x1415B 2856 bytes
SHA-256: 72e034d469ad784d702cd9432eec98bacc9a6fd5a4301c8dc5c84764a4e1c373
font_08_type1_off00014cd9.bin pdf-font-stream PDF embedded font (type1) at offset 0x14CD9 1900 bytes
SHA-256: ce7a4dee68d965ef681ae5f8808f591ce589064151315e29752aca0c42ca190f
font_09_type1_off000154b8.bin pdf-font-stream PDF embedded font (type1) at offset 0x154B8 12081 bytes
SHA-256: 186ce35d12371fe5e19c883823502ed8743e7a7e10aca08b5b67873f2978c1b7
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.89, consistent with packed or encrypted content.
font_10_type1_off00018297.bin pdf-font-stream PDF embedded font (type1) at offset 0x18297 6069 bytes
SHA-256: 1b625be14323a5c18e3f41da21ada757adf580f8167f85119c7ce091c906fa8b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.83, consistent with packed or encrypted content.
font_13_type1_off000220ae.bin pdf-font-stream PDF embedded font (type1) at offset 0x220AE 13654 bytes
SHA-256: 13d00489f95fb86f94a877378f2acae700c6388c13beccf69e2e82422e5f25d5
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.92, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.