PDF static analysis report

Static analysis result for SHA-256 fb90b50e2f7af729…

SUSPICIOUS

PDF

316.0 KB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-26
MD5: 4a931f26099bc21975a858c09cfe701a SHA-1: b165fd30be7a2a3cdf780e0852b7e9ce65cb1e86 SHA-256: fb90b50e2f7af72938cae28d99ece2eddbb4dbba6b45819ab14c4f61df52d8ed
40 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 1

  • Travel-support phone-number stuffing scam high SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
🗂 Part of campaign: volaris.com 813 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_033_off000324bf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x324BF 146120 bytes
SHA-256: 2b5b87ddf259818c27c0a2c47fd8fca48db956fb9e9c16115e0d7589583a4ea3
font_01_sfnt_off0003a832.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A832 218628 bytes
SHA-256: 9ec0fe7b9c5f97f863c07e7a17071b492a4baf28620dc8c323e7ecca69d752cc
font_02_sfnt_off0003bbb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BBB0 44968 bytes
SHA-256: fb9ce2072d3ddff24596639917e9d9f911de92eb9e1c7aef30fc30cdbcb05632
font_03_sfnt_off00046fb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46FB3 25068 bytes
SHA-256: e899bca330a13a4ecdd67e2741bcb4149ca2f7111add56c2093f8b6d6f86b3f6
font_04_sfnt_off0004b4e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B4E4 13152 bytes
SHA-256: 58aec45fb3b2268b803c057dd69630c934fc69b0e5076d8d4f972aabe3e1918a
font_05_sfnt_off0004bc77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4BC77 1000 bytes
SHA-256: 8852dc3465b293666e0341adfee088f623b0d3b79f4a265559d031001c00af63

Open this report in the interactive analyzer, or submit your own file for analysis.