Malicious PDF — malware analysis report

Static analysis result for SHA-256 14aac6a2162ae223…

MALICIOUS

PDF

345.5 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-23
MD5: 2501ccbec372717b2598ae0c63dbdf17 SHA-1: 603d68906e2a68db5ff659bf046e30a929c9c1c3 SHA-256: 14aac6a2162ae2235078c3928dd59d079a2db6ae933fe2468be903af8611907e
100 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 3

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off0001c8f0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C8F0 149952 bytes
SHA-256: 51c1dfa02d947bc7c46cc07dd97faf83ff4a34cb91a7e4072c9f86e23ae17cc7
stream_013_off000255f8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x255F8 18240 bytes
SHA-256: bfa5ef532fe91217e0c8ff29723db0abdb40bfb1d246175da1a6cbc77b40432b
stream_025_off0002c89f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C89F 18240 bytes
SHA-256: 40e421321e795e26ef42df8f532d3ea5ea8f2c595c2f46e8bbf04c2cd9121b4a
stream_033_off00030e80.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x30E80 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_00_sfnt_off0001b3c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B3C6 221616 bytes
SHA-256: ce5760de525c120605253b3b4b18503c27b85a7674b91eca9f99770f0944ceaa
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x04
font_02_sfnt_off000337ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x337EF 68556 bytes
SHA-256: cbfb3a21a5e9a89771aaa84b044a62a5ec8dfdf2b986c63e4696937647ed9058
font_03_sfnt_off000526d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x526D1 13792 bytes
SHA-256: a057924d03d1b49c03817e5d18c7eb6f786732407869540be0e8b5e2969a5307
font_04_sfnt_off00052de8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52DE8 47796 bytes
SHA-256: e63a51dfd52b6a8c3166c59ef4814eb245c5181b09637107ec97ab4eb48e1cf5

Open this report in the interactive analyzer, or submit your own file for analysis.