Malicious PDF — malware analysis report

Static analysis result for SHA-256 c63b91be96bf3de8…

MALICIOUS

PDF

589.0 KB Authoring application: Skia/PDF m149 Google Docs Renderer First seen: 2026-05-19
MD5: 981d1efe1b25bfbc050608811e372acf SHA-1: c5944592a2ef6a2dd8675097bb6a015a7432fd6e SHA-256: c63b91be96bf3de8a2f82504eda172ed9adb6f4a0878a6cd37f1799f0bc41e61
80 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_031_off00044676.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x44676 151456 bytes
SHA-256: bff70e68e825e97a24d14c0e4028af9fc34fd4f4955d987a45a407ea74b3d676
stream_089_off0006a968.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6A968 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
stream_118_off0007b47f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7B47F 18240 bytes
SHA-256: a2c05697b5e85ae44c5ebbd7043315fd0deb6c369eb3c21604d8d63feb3c8170
stream_143_off00089f1e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x89F1E 18240 bytes
SHA-256: 90ffe6d399b4bb962fbda333006a9f2354a1ce569686392423cf313673018844
font_00_sfnt_off000432ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x432EC 218780 bytes
SHA-256: 2e9e9694bc639535f50d01e1eede9e17807e457f242a260bdf6b78490d892a09
font_02_sfnt_off0004d603.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D603 28412 bytes
SHA-256: 255bd5ae3c998338d132b0ece37aa79dada72a37516d87312522e63664397718
font_03_sfnt_off00059458.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59458 49624 bytes
SHA-256: 8e280b6003f043f2a7113a1fc659c4ac5f80f6171e2844d57c029535910ae411
font_04_sfnt_off0008c193.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C193 11036 bytes
SHA-256: eac798ca22a3ab4a2372d0f30c1953158edda0eacc6b8f5cb8482e14dd43037d
font_05_sfnt_off0008ec59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8EC59 6096 bytes
SHA-256: 03c02e05377f87b7ffcfeecda6ee9d693b22f57d196f7e92f5eec09b0c4d8096

Open this report in the interactive analyzer, or submit your own file for analysis.