SUSPICIOUS
44
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0003
Heuristics 4
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
-
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.net/ PDF link annotation
- https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.netPDF link annotation
🗂 Part of campaign:
volaris.com
813 samples
Extracted artifacts 8
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off00056ce1.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x56CE1 | 753738 bytes |
SHA-256: cab69d0ac52ba444dabe59db702773d3fc2af50a63ee2eab7bbfbec4fc2eb314 |
|||
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x0C
|
|||
icc_00_off00000257.icc |
pdf-icc-profile | PDF ICC profile at offset 0x257 | 536 bytes |
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d |
|||
font_00_sfnt_off0008be77.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8BE77 | 40632 bytes |
SHA-256: 481c00fb763a7caff64a874aa24440492fc7e9610874401ad60b62edc0d15b80 |
|||
font_01_sfnt_off000920b1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x920B1 | 26180 bytes |
SHA-256: c6de78347b2a5c3976a52479e0fe9a4bb1987009bd91b21324bdb9bd8b26afdf |
|||
font_02_sfnt_off000968f4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x968F4 | 14752 bytes |
SHA-256: 4f43a15c9addd8b749783cdd23bdea118297db0d56fd3f7025fd2c1274c6f61b |
|||
font_03_sfnt_off0009923a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9923A | 21472 bytes |
SHA-256: 82361f04260e65102b527d5d855deb15f55d8f89e34d1d46cff2b0366d1ec660 |
|||
font_04_sfnt_off0009c6e7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9C6E7 | 183608 bytes |
SHA-256: f698ceb1dbf94ffc5db2c031eca18e0c6757ab3edd838b19657e81f83f521013 |
|||
font_05_sfnt_off0009d669.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9D669 | 39948 bytes |
SHA-256: f0fe87d1e8944607f528e482896fdd102706cbbd4878a7cda2ee609508c22868 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.