Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d7c66bfe6813ce1…

MALICIOUS

PDF

660.3 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-23
MD5: 5e3863f4a6462729d4b400ec9d7c51d3 SHA-1: 74e75e9089ef822b199068a19b03a30c662b0296 SHA-256: 9d7c66bfe6813ce1e81d9ec3a1a128b24bb1e9469b68eb6cac1392b457ce99a6
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 4

  • Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.net/ PDF link annotation
    • https://24e34ef4y9ij4-fdjj-j4j0tf6.hop.clickbank.netPDF link annotation
🗂 Part of campaign: shared payload 81976b9c3a 52 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00056be6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x56BE6 753738 bytes
SHA-256: cab69d0ac52ba444dabe59db702773d3fc2af50a63ee2eab7bbfbec4fc2eb314
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x0C
stream_023_off0008ad91.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8AD91 55724 bytes
SHA-256: 761903bab1e4c4d80e5129fd5348e859d5a3dc87ccb38400a1e04fae70370187
icc_00_off0000023f.icc pdf-icc-profile PDF ICC profile at offset 0x23F 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_01_sfnt_off000925fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x925FE 36196 bytes
SHA-256: 81976b9c3a4ee4323810c93284ce658c509ee7f206a633b417c98ed9f6366e6c
font_02_sfnt_off00098382.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98382 22292 bytes
SHA-256: 9a0af079612a5628793a0eca85d85e8e9c3c55eca991e1c2ecfc6dccef76f6a2
font_03_sfnt_off0009bc3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BC3F 24448 bytes
SHA-256: 44defc8fbe7d02fabb7bcfbca14a39ace2b03bef22e762c7c7d9b34648329aed
font_04_sfnt_off0009f54e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F54E 182224 bytes
SHA-256: 2686c264230b0366b437fa14fc351fe83ea929781aab89234dbb519f59950e29
font_05_sfnt_off000a01c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA01C7 129020 bytes
SHA-256: d1e99dafdf2672759a3675eca54f2c8f7e3faf63bcd81c0a9f5ba0fc5dba040e

Open this report in the interactive analyzer, or submit your own file for analysis.