PDF static analysis report

Static analysis result for SHA-256 e0be11b31cfd47aa…

CLEAN

PDF

262.6 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-26
MD5: e11b6be3fdba8436ba9d66af6f64b026 SHA-1: 1e075d0d2fdf9c517b1e2d15702162b845ecfaba SHA-256: e0be11b31cfd47aaa06d2ef5626ffe486cdb7d7133366da4f72aecc53448618b
20 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_022_off000231ca.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x231CA 148428 bytes
SHA-256: 93aa08d0cb62e5549c9576636c3f86022e52fc11439a1f64dea35131c8aad428
stream_032_off000301f7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x301F7 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_01_sfnt_off0003795a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3795A 217460 bytes
SHA-256: ebe08c931f03ad7880d6b56f6c6b9acea8c364f5b25be2596da2d551c33c77f9
font_02_sfnt_off0003d2ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D2EF 27164 bytes
SHA-256: e4eb59ecce6f823dd74ab597f4f34fe1aec1b4cc45acfa3c5c058081d20188bd
font_03_sfnt_off00040743.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40743 6096 bytes
SHA-256: 03c02e05377f87b7ffcfeecda6ee9d693b22f57d196f7e92f5eec09b0c4d8096

Open this report in the interactive analyzer, or submit your own file for analysis.