Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9859eb9eabff6e6…

MALICIOUS

PDF

276.0 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-23
MD5: 31b62c916118c773ffc1eadbf6ae5005 SHA-1: ea2ef6b73d2ea5404ca0fdea396cd207e4b6556c SHA-256: c9859eb9eabff6e636ffd52d635d30ce1799c8986cb7ccdcb16f925bc522ed33
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_014_off00015d06.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x15D06 145168 bytes
SHA-256: 2d5fb4ba76a764e9288db1352565f99ffb9bd3df01ea83f75f9a1135a0769b5f
stream_037_off0002d2ad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2D2AD 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
font_01_sfnt_off0001dcd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DCD3 217604 bytes
SHA-256: e044e9dd4d35acae3829735e9dd6fbcd7adaab2daddd9ef40c0e27b6d54ecce6
font_02_sfnt_off0002025e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2025E 105608 bytes
SHA-256: 541c8dce05f6f4757e08211649adb49c3d0115ca31342f9588925953564f74e0
font_03_sfnt_off000263bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x263BC 49412 bytes
SHA-256: 90077ef06003b64e68e0881b0b34b0491dfd0ed928cccc0c553e14a7aaab4c68
font_04_sfnt_off0003293d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3293D 5704 bytes
SHA-256: 06a458f427337f2a88d57fc2db8a29608f497774d792c7ae837ce2b5a0a43f23
font_05_sfnt_off00033b2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33B2C 134312 bytes
SHA-256: bc556f4f47c60fdb04ee5ac5b7f24601caea2f9f7326023bdf0f0025ea5ebc1c
font_06_sfnt_off0003a49c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A49C 6380 bytes
SHA-256: 2b16223613914648c402a2f9724b639627f9e26c180132d4ce5202ebbd2cfa8d
font_07_sfnt_off0003b7d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B7D5 10772 bytes
SHA-256: a38386d235cb8fde479c073bbabeeb44e7f5c480001fd3def913e27b42b7ec0a
font_08_sfnt_off0003f3d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F3D8 13508 bytes
SHA-256: bd9e83287b0d68b69d51ade3b1a6d88c9d79616100fdc6bf8b94f35bdafefa18
font_09_sfnt_off00042bb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42BB1 163312 bytes
SHA-256: 6f505579fe1fd292b58a7301cbd8f3757ac6910de740deadd13a6ebeeea7e3aa

Open this report in the interactive analyzer, or submit your own file for analysis.