Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1bed23feecdf82c…

MALICIOUS

PDF

372.8 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: b87fca80e8d043d342594b7eb4312b6a SHA-1: e1479ba9e9dd42dc49e6aa78356ecc9d84aea2a4 SHA-256: e1bed23feecdf82c7f5bae86e03c197f2ab6c5b477c6fa24c5cc75d038cc0aa0
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_037_off0001b77b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B77B 18240 bytes
SHA-256: 33e060654ed1208fc726f2323a8a9e7d9de6f6c8c2aedd340c7ed605b422fc95
stream_060_off0002601f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2601F 49392 bytes
SHA-256: efaea02ba50ee7be31ec2e5bb10a65c86f16258bc5964db85a9804f1f40cb68c
stream_087_off00040cc5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x40CC5 18240 bytes
SHA-256: a2c05697b5e85ae44c5ebbd7043315fd0deb6c369eb3c21604d8d63feb3c8170
stream_109_off0004bca7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BCA7 18240 bytes
SHA-256: b31723e0d005affb7530938fc451261d1cafccdb994abb61b86afe7f9312607a
font_01_sfnt_off0002d753.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D753 214620 bytes
SHA-256: 66023fe4639a039ac82734979c0c20c5bc844affa021c811490273a646113592
font_02_sfnt_off0002e4b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E4B8 38072 bytes
SHA-256: 1f7609a9abcc4859c2ea57ae94510f77243281b31719b4d37574e2a0e17b765e

Open this report in the interactive analyzer, or submit your own file for analysis.