Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b6c20322d755a17…

MALICIOUS

PDF

273.3 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-23
MD5: b19e3128e742263aeaae6d29e493da56 SHA-1: 783affd74690878367278f33bc8460cbe5082fbf SHA-256: 5b6c20322d755a175c84c1b45832342f2a1c98e4f455e5959c021c18b6a49abe
80 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off0001b7c5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B7C5 151220 bytes
SHA-256: 254fc6d9978b371a457f3202913e2e0fd79df9a658a1c7269bbf765c0363c3d4
stream_018_off0002c4cc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2C4CC 18240 bytes
SHA-256: ab5f571bf0cd18a495d3ad2095b48edc8a90a4ff34d2cb5d46c82eaa51a75def
stream_022_off0002e448.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E448 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_01_sfnt_off0002476a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2476A 217436 bytes
SHA-256: ce9289c85b1a703935e61b35b5383567e4472521a70785fddd8b88bf30409ad9
font_02_sfnt_off00025721.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25721 13508 bytes
SHA-256: bd9e83287b0d68b69d51ade3b1a6d88c9d79616100fdc6bf8b94f35bdafefa18
font_03_sfnt_off00027987.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27987 28992 bytes
SHA-256: 50224f3372a366c5bd1a2ae2e68e0174ef290840034810e65c8233c415de68f7
font_04_sfnt_off00031768.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31768 14612 bytes
SHA-256: 7a3a59c025a13be27794167c244b4732bf2a7da8236ca0fcea1c37e822861d9f
font_05_sfnt_off0003cfca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CFCA 50208 bytes
SHA-256: 305bf8c7a76ca05575d24c7c0fa3c8ce32844576d3cdaa976f680868b869fef6
font_06_sfnt_off0003df32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DF32 47796 bytes
SHA-256: e63a51dfd52b6a8c3166c59ef4814eb245c5181b09637107ec97ab4eb48e1cf5

Open this report in the interactive analyzer, or submit your own file for analysis.