PDF static analysis report

Static analysis result for SHA-256 9edb1a0fc5255a59…

CLEAN

PDF

669.3 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-28
MD5: 6f82549db7d45fe22c81645d3eb0f93d SHA-1: 639c4e64671b3fd9ab8245dd581262495f7bfb44 SHA-256: 9edb1a0fc5255a594bac5eafaac4159d70f256e59fa5ed93c926c28a829ace18
20 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_031_off00058758.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x58758 145052 bytes
SHA-256: 257a6cdea844551d3c37b526ea9c0c0fd613534bede6a1815d2b93032a23edc0
stream_063_off00074c4a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x74C4A 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_00_sfnt_off00054aa1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54AA1 25656 bytes
SHA-256: 7e9714171a9bccb0fc9f38d2fba6bdb2d80f6510ecce95474e60cfa950d56bae
font_02_sfnt_off0006024e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6024E 132644 bytes
SHA-256: dfee1aefb30cf0c6f0f984507019e3f46dabc45e349f5d4a83b1e6adda35bb85

Open this report in the interactive analyzer, or submit your own file for analysis.