Malicious PDF — malware analysis report

Static analysis result for SHA-256 af1d0cee5487e57b…

MALICIOUS

PDF

337.5 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: 89711572a5a8a80c53f7152e9b6d8e9c SHA-1: 521007eb6ce669cf97e3434a331f6f0043eac443 SHA-256: af1d0cee5487e57b072e990003e50f9c53d431c549d6c3f9f2eb505c94fee8b8
80 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_021_off00035b29.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x35B29 151768 bytes
SHA-256: f4dd8cd091dd6a94d21a6dd777f5beeea2d45d8879c5f976d49069c0f6816bdc
stream_040_off0004b92b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B92B 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_00_sfnt_off00033f5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33F5F 6236 bytes
SHA-256: 7cf02592db540540a9d5e4138ad8e974a7ad21df76fc637c27d25c5b64286748
font_01_sfnt_off00035377.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35377 15072 bytes
SHA-256: 5a9135c1d6c945396da793a71de46ce394a9d4a411a7e0e5f363fe2f4e5bf429
font_03_sfnt_off0003ec62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EC62 217456 bytes
SHA-256: 3a4b6f042fcacd60a9b6fc1488e24864786467540f857007c88e9af8dbee230e
font_04_sfnt_off0003fc29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FC29 13508 bytes
SHA-256: bd9e83287b0d68b69d51ade3b1a6d88c9d79616100fdc6bf8b94f35bdafefa18
font_05_sfnt_off000445fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x445FC 27228 bytes
SHA-256: 2f92d17db97d38b63753fb122637b655d14e35ff693cebb97600c14053d81786
font_06_sfnt_off00048814.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48814 49468 bytes
SHA-256: e8dc7726f51ccabd63db592fb1c280085a351bb2e133fa2616348fbde40860c1

Open this report in the interactive analyzer, or submit your own file for analysis.