PDF static analysis report

Static analysis result for SHA-256 8eba065020f871aa…

CLEAN

PDF

215.1 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-28
MD5: 268c1fecc5575bdc7048af27523def90 SHA-1: 8d7ebef2350a3b6830b5252ec2fc09f89e502d05 SHA-256: 8eba065020f871aa4e8d66b688955ceb6474a3e4fd180c7c3e7238f84f162293
20 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off0001bd60.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1BD60 148464 bytes
SHA-256: 3339b8ec17f63d5f5d485d6d946e304543f06a9c256c2fe68cdf2642dbe49443
stream_031_off0002be43.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2BE43 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_01_sfnt_off000245dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x245DD 183244 bytes
SHA-256: 3c3c51bec3252b8b99c3e9133f0bd83aa6f5205e0eaef14e732bbc8f6ea2a0dc
font_02_sfnt_off0002e745.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E745 45440 bytes
SHA-256: df9715da8bb7c731bf8f324a29fc480781919f6fb5dfc6296b72fb5acdca555e

Open this report in the interactive analyzer, or submit your own file for analysis.