Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ea8a36946c268f3…

MALICIOUS

PDF

524.5 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-25
MD5: 77bab5f1093590a04a2dd4c918569e08 SHA-1: 73c422dc207823b2430f8f709fbe606d26cf895e SHA-256: 6ea8a36946c268f3fa693301bea51d258ce681f68b346797155fbd090e267ab1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The heuristic SE_TRAVEL_SUPPORT_PHONE_SCAM indicates that the document body contains an excessive number of phone numbers, a common tactic in travel support scams. The document body itself is heavily obfuscated and appears to be filler text, reinforcing the scam pretext. No scripts or external URLs were extracted, limiting further analysis.

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_018_off00037f75.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x37F75 150872 bytes
SHA-256: 493af4a99fdb6f48b5c30ff67a1ad73dac105905289a6f67b91e35ce4dbfa10e
stream_088_off0006a4ad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6A4AD 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
stream_126_off0007cc1f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7CC1F 18240 bytes
SHA-256: a2c05697b5e85ae44c5ebbd7043315fd0deb6c369eb3c21604d8d63feb3c8170
font_00_sfnt_off00032c7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32C7C 28168 bytes
SHA-256: 24d9381541167d719158d6a8f921f467e33497aceaebd7a740674c1b57481f3d
font_01_sfnt_off00036e5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36E5C 188244 bytes
SHA-256: 05db1037b30b429847d9ee2072eb0dc2c0f73e0315071e265b54a810759db44a
font_03_sfnt_off00040e2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40E2C 27964 bytes
SHA-256: e20a3c92b5204350016362e510bbe4f36aff5cb1bd2395328f9e0846ea6ec5d3
font_04_sfnt_off000441f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x441F0 57040 bytes
SHA-256: 932afc4da525f7c251ca1592f344459cbafe78b7d576e9a9c5a0587060236d4a
font_05_sfnt_off0007ea17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EA17 6096 bytes
SHA-256: 03c02e05377f87b7ffcfeecda6ee9d693b22f57d196f7e92f5eec09b0c4d8096

Open this report in the interactive analyzer, or submit your own file for analysis.