MALICIOUS
60
Risk Score
Machine Learning
- Nyx PDF Classifier clean score 0.0001
Heuristics 1
-
Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAMDocument repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign:
volaris.com
813 samples
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_016_off0003e319.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x3E319 | 152492 bytes |
SHA-256: 4850f651d6924fe618337ea881fd1aa4655511ae62303b4d326608e8e7499c9f |
|||
font_00_sfnt_off00039cb3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x39CB3 | 124020 bytes |
SHA-256: 568fc03fcca90892f4ea5adbe0bbb9e44f0b4d3226c60e9a492e78511adaa7da |
|||
font_02_sfnt_off000476ee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x476EE | 50252 bytes |
SHA-256: 8ad3d8113146f03ef6d6e606b3e200e0a585c8f6ac44f0c6a486b6c116a17917 |
|||
font_03_sfnt_off0004ef49.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EF49 | 68100 bytes |
SHA-256: 9b03ddf5b10dd7db4b8bc7c6fa30ffa1127828ed7b307f173085ae5142df297f |
|||
font_04_sfnt_off00051f9a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51F9A | 217104 bytes |
SHA-256: 3b1e1de6ff7a425c54bef20f3927be25f055268905686f5787257bca51ac5763 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.