Malicious PDF — malware analysis report

Static analysis result for SHA-256 0645d443879a737b…

MALICIOUS

PDF

380.3 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-20
MD5: cb75bd792ba94a6b7e0b75fef339482b SHA-1: 3cb6a82a12ee2dd4afb036384acf5d50528e3cfc SHA-256: 0645d443879a737b42bb75724ac6ab1d6c105fb00e8514e4cdac68d8c83664a2
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_018_off00030e27.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x30E27 151008 bytes
SHA-256: 4cde9a16583004d81732147d4ec170889f09beadec4af2044e4a610234f83a44
stream_054_off0004ff3f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4FF3F 18240 bytes
SHA-256: ab5f571bf0cd18a495d3ad2095b48edc8a90a4ff34d2cb5d46c82eaa51a75def
stream_060_off00052acd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52ACD 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_00_sfnt_off0002ca8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CA8E 27584 bytes
SHA-256: 11fd161ee56ca257441c26b52131cf467d285dc3a983bbf06b6bc7578bf3be43
font_02_sfnt_off00039d0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39D0B 55604 bytes
SHA-256: c691d41c3174404d0793f47f83ca79041e415d5a2fd78bf040cc81ec55a38958
font_03_sfnt_off00057b71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x57B71 217600 bytes
SHA-256: 2d9d9516eed135eef6783743afde6740de27eaff975bfcc316b5548a7c855344
font_04_sfnt_off00058b6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58B6D 50400 bytes
SHA-256: 3933f0a171d2e1d52238afd1697f635a25c78debe3762eae68e9de3aebda16b8

Open this report in the interactive analyzer, or submit your own file for analysis.