Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a01715ef9ead3d0…

MALICIOUS

PDF

356.4 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: 19719902a6c435564b69123a5d2f274e SHA-1: f140dcd94a07816041090f708d74fcf506ea77ab SHA-256: 6a01715ef9ead3d03cfada617d7be16ad65403b20ff8446181caa47b70d8b24b
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0003e319.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3E319 152492 bytes
SHA-256: 4850f651d6924fe618337ea881fd1aa4655511ae62303b4d326608e8e7499c9f
font_00_sfnt_off00039cb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39CB3 124020 bytes
SHA-256: 568fc03fcca90892f4ea5adbe0bbb9e44f0b4d3226c60e9a492e78511adaa7da
font_02_sfnt_off000476ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x476EE 50252 bytes
SHA-256: 8ad3d8113146f03ef6d6e606b3e200e0a585c8f6ac44f0c6a486b6c116a17917
font_03_sfnt_off0004ef49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4EF49 68100 bytes
SHA-256: 9b03ddf5b10dd7db4b8bc7c6fa30ffa1127828ed7b307f173085ae5142df297f
font_04_sfnt_off00051f9a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51F9A 217104 bytes
SHA-256: 3b1e1de6ff7a425c54bef20f3927be25f055268905686f5787257bca51ac5763