Malicious PDF — malware analysis report

Static analysis result for SHA-256 00eaa1d8992099ad…

MALICIOUS

PDF

42.8 KB Authoring application: Pdftk First seen: 2026-05-09
MD5: aef47cdd6c0bb59448a391ff1a555173 SHA-1: a110087397fa9777949ee9b8f64fd0312374432e SHA-256: 00eaa1d8992099ad451a02d97be12b8808db64b17d8cb8da17450009a1f84d38
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of embedded links to external PDF files hosted across various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead users to malicious content or phishing pages. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abileneallies.com/uploads/1/3/0/2/130287977/kasarebog.pdf In PDF document text
    • http://nicole-florio.com/uploads/1/3/0/5/130540869/4541406.pdfIn PDF document text
    • http://seelooinc.com/uploads/1/3/0/5/130540406/gaperuposig_kubuxitap_kezinonagige_wesutotifupi.pdfIn PDF document text
    • http://dmitrithompson.com/uploads/1/3/0/8/130874136/wapobeworanuwuzap.pdfIn PDF document text
    • http://bethegoodhands.com/uploads/1/3/0/5/130588907/54a83.pdfIn PDF document text
    • http://www.energohubsg.com/uploads/1/3/0/5/130551049/bc120a0b5b.pdfIn PDF document text
    • http://myeasystudy.com/uploads/1/3/0/5/130589040/fabagugeze-zagal-rovogesitojuwax-wegax.pdfIn PDF document text
    • http://attorneygarvey.com/uploads/1/3/0/3/130323475/dimelomelo.pdfIn PDF document text
    • http://domainchangers.com/uploads/1/3/0/4/130479350/fuluzabuvup_rojav_zazexigadez.pdfIn PDF document text
    • http://michiganroofmasters.com/uploads/1/3/0/4/130435791/zunomepowila.pdfIn PDF document text
    • http://mta-sts.mail.granolaee.com/uploads/1/3/0/4/130477192/kikogifadizotu-doxovikafewal-jopugerazesoloj-wadumobiva.pdfIn PDF document text
    • http://agrseedandsupply.com/uploads/1/3/0/8/130814967/jegal-kuboxedanej-lonivamivarap-nasodunaw.pdfIn PDF document text
    • http://ninagandhi.net/uploads/1/3/0/5/130588508/tenebo_fazim_pepogozore.pdfIn PDF document text
    • http://lloretnews.com/uploads/1/3/0/7/130776175/f6213bed.pdfIn PDF document text
    • http://beyondsoftware.com/uploads/1/3/0/6/130621273/fepono-xulogeravuf.pdfIn PDF document text
    • http://countingwithelliot.com/uploads/1/3/0/2/130289571/geralejepuder.pdfIn PDF document text
    • http://priyabery.com/uploads/1/3/0/6/130620370/6021580.pdfIn PDF document text
    • http://nightingaleicecreamsandwiches.com/uploads/1/3/0/6/130639222/mudosa_xafowuneg_geferog.pdfIn PDF document text
    • http://nysmaplepartridge.com/uploads/1/3/0/7/130739850/tugozasebopor.pdfIn PDF document text
    • http://roxandree.com/uploads/1/3/0/6/130604336/5401268.pdfIn PDF document text
    • http://replicatorsystems.com/uploads/1/3/0/6/130639360/2937584.pdfIn PDF document text
    • http://vesselhouse.co/uploads/1/3/0/8/130814192/c0cd1328.pdfIn PDF document text
    • http://nathanielrichguitars.com/uploads/1/3/0/2/130272385/5129342.pdfIn PDF document text
    • http://checksymptom.com/uploads/1/3/0/7/130774973/dekageza_nagudi.pdfIn PDF document text
    • http://mondokdentalmexico.com/uploads/1/3/0/2/130291673/kufekeribeb_vasavifoso.pdfIn PDF document text
    • http://she169.brdge.org/uploads/1/3/0/6/130620965/130620965.html#s+bahn+fahrplan+berlin+spandauIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004058.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4058 9232 bytes
SHA-256: eda0c901f76488cbb4699fb87bb56b7c7d96849b4bc4dd26e6b24443bdfe1227

Open this report in the interactive analyzer, or submit your own file for analysis.