Malicious PDF — malware analysis report

Static analysis result for SHA-256 e99a7f2cd3cd82e5…

MALICIOUS

PDF

66.8 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-20
MD5: 4bd1f2cfebcda98f9a64f1fceb7f9770 SHA-1: 9ae8f8c83ef40fda3ef447ed4aff2a5b7969d9a8 SHA-256: e99a7f2cd3cd82e5ae959b86d6569be92338262ff648dc93d7782b81ab2e0d69
80 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003821.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3821 3568 bytes
SHA-256: b28bad04e3eebcff39e9628528149c00e51b7334a531cf21561add944f07f878
font_01_sfnt_off0000448f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x448F 52760 bytes
SHA-256: 4a5154d8f44a41c781a14c769393fc44a7258347f5e40f8db426f7721bb4b27f
font_02_sfnt_off0000b92f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB92F 13856 bytes
SHA-256: edfd70aaffbb7d25469ec6e9c96fa09665406120049426032f7620b5141bc613
font_03_sfnt_off0000daa8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAA8 182820 bytes
SHA-256: 3aed9dd16e70cc30dd94f4f7b86ed9eddd9fede2584d325ec6eff1d363192f80
font_04_sfnt_off0000e741.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE741 49524 bytes
SHA-256: 4c24040b68ccc42eb4eb7f8749d0c75753dda90201b99a5bb7b49a3dcdfb47b8
font_05_sfnt_off0000f366.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF366 6408 bytes
SHA-256: 1446f1bb56b1c5ce77dee95a9d422f007651ec1ec74ad85da5247f6589536d01

Open this report in the interactive analyzer, or submit your own file for analysis.