Malicious PDF — malware analysis report

Static analysis result for SHA-256 388569919d9e96a3…

MALICIOUS

PDF

329.6 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: 65dc28052c26739cfef2205d8d2da489 SHA-1: 2f43642dc7a1fdeecc09ca9186f16db7da0f5614 SHA-256: 388569919d9e96a32157f2e3c580f5be194151509ef4a054758e7926ba07f36b
80 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a large amount of repetitive text designed to trick the user into calling fake support phone numbers, consistent with a callback phishing or tech-support scam. The heuristic firings indicate a high volume of phone numbers stuffed into the document, and the doc body explicitly provides multiple phone numbers for 'Turkish Airlines' customer service, aiming to deceive the user into initiating contact.

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_020_off00033c5e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33C5E 151768 bytes
SHA-256: f4dd8cd091dd6a94d21a6dd777f5beeea2d45d8879c5f976d49069c0f6816bdc
stream_039_off00049a0d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49A0D 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_00_sfnt_off00032094.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32094 6236 bytes
SHA-256: 7cf02592db540540a9d5e4138ad8e974a7ad21df76fc637c27d25c5b64286748
font_01_sfnt_off000334ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x334AC 15072 bytes
SHA-256: 5a9135c1d6c945396da793a71de46ce394a9d4a411a7e0e5f363fe2f4e5bf429
font_03_sfnt_off0003cd97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CD97 217456 bytes
SHA-256: 3a4b6f042fcacd60a9b6fc1488e24864786467540f857007c88e9af8dbee230e
font_04_sfnt_off0003dd5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DD5E 13508 bytes
SHA-256: bd9e83287b0d68b69d51ade3b1a6d88c9d79616100fdc6bf8b94f35bdafefa18
font_05_sfnt_off00042731.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42731 27112 bytes
SHA-256: 4c60a725c79cabbdec563c82b3a1fc4dca31d9f1a9034c07e0307d19e67cb225
font_06_sfnt_off000468f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x468F6 49468 bytes
SHA-256: e8dc7726f51ccabd63db592fb1c280085a351bb2e133fa2616348fbde40860c1

Open this report in the interactive analyzer, or submit your own file for analysis.