Malicious PDF — malware analysis report

Static analysis result for SHA-256 b10e6a2a2096d10c…

MALICIOUS

PDF

385.2 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-17
MD5: 09ec484ddb3bf748b6204746b9fa6b6b SHA-1: 458add04d260c672b611bc3ddd8d53c4e4050c20 SHA-256: b10e6a2a2096d10c1f0f6e20beca2209b2c3ba9d4a0b4c030538e691b0b51556
84 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 4

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wwws.airfrance.com.mx/ PDF link annotation
    • https://wwws.airfrance.es/In PDF document text
    • https://wwws.airfrance.com.mx/check-inIn PDF document text
    • https://comunicacion.buap.mx/sites/default/files/webform/denaffu_Airfrance_2.pdfIn PDF document text
    • https://rpal.juridicas.unam.mx/sites/default/files/webform/airfrance-betahaitumera7.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_015_off00026d5a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x26D5A 147464 bytes
SHA-256: 8c7940ac99e01cc93994fc483f97e87cc9658ca09ed53bfa17cc966ee2daa164
font_00_sfnt_off00022b3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22B3C 28704 bytes
SHA-256: 2dd938276bfe90468bbe2b99f11d3db0d73540098c62daa5eb9a308ca1327402
font_02_sfnt_off0002f107.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F107 20872 bytes
SHA-256: 0ab1166c592233bba071d70241290c336ec9c97d76669d2000c842a4fc2c5a20
font_03_sfnt_off0003262a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3262A 26796 bytes
SHA-256: 07932859811c49e16fb1725b101760f75c6d18917f2a5e47fdcfe111803a109f
font_04_sfnt_off0003694e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3694E 41032 bytes
SHA-256: 057e3dff50b4be59e8fce4e66eebb229d7a38cccb14f686239e8b088e4941ff9
font_05_sfnt_off0003c91a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C91A 52668 bytes
SHA-256: 6dc16b0a44128cd0c6dcc04b1053af6b646a87381a9fdefb26125f1a802180db
font_06_sfnt_off0004083c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4083C 36244 bytes
SHA-256: ca94335c000165eb98e98ef449692fdb7bd8c9ea6de3cba1504ed86de133ba6e
font_07_sfnt_off0004646c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4646C 34328 bytes
SHA-256: 831dab732faab64a7fe5f643be77857d222593eed4d37cf4779d458011de27b8
font_08_sfnt_off0004b93a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B93A 22992 bytes
SHA-256: e5f01b0436e37f4b0e23a8c60b9af6e3d4a1e322ad00351e98207a70ce7cd05c
font_09_sfnt_off0004c48e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C48E 16404 bytes
SHA-256: 53c78aab61a7fc6312edb860fca8413747857c77cf259fbe6df1968014c854ea
font_10_sfnt_off000575c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x575C0 215088 bytes
SHA-256: 66aa52b0012c2d512cc06f8f1b9527c78caebd79f49cdedc165226302971fdc4

Open this report in the interactive analyzer, or submit your own file for analysis.