Malicious PDF — malware analysis report

Static analysis result for SHA-256 14aca8786d35c7a3…

MALICIOUS

PDF

47.9 KB Authoring application: Adobe PDF Library 9.0 First seen: 2026-05-08
MD5: 5b59149b6ba36fa5294aa829fdb309ab SHA-1: 773429627154a202e4b1907489f6579d58cf5d8a SHA-256: 14aca8786d35c7a3c99db9e46a4535f372d02f6ef2f02feada50da848995ea14
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute additional malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://keykidoll.com/uploads/1/3/0/3/130313220/76d61730f5ff.pdf In PDF document text
    • http://cheriward.com/uploads/1/3/0/4/130435941/xupokedapup.pdfIn PDF document text
    • http://meganrybacki.com/uploads/1/3/0/5/130540397/6119324.pdfIn PDF document text
    • http://ketocoacher.com/uploads/1/3/0/6/130639019/dotido.pdfIn PDF document text
    • http://jenniferstefanac.org/uploads/1/3/0/4/130490053/2275cc7e8.pdfIn PDF document text
    • http://canadianly.com/uploads/1/3/0/8/130814145/fe37aaa3b.pdfIn PDF document text
    • http://teacupsanddresses.com/uploads/1/3/0/8/130813510/5847517.pdfIn PDF document text
    • http://djsacademy.com/uploads/1/3/0/7/130738658/desizofesiwog.pdfIn PDF document text
    • http://almahruqicars.com/uploads/1/3/0/7/130775174/7872595.pdfIn PDF document text
    • http://northcountypawscause.org/uploads/1/3/0/7/130738779/wololuva_gutisovubi_bijep_loparogog.pdfIn PDF document text
    • http://sheqplanet.com/uploads/1/3/0/5/130589420/91924b781.pdfIn PDF document text
    • http://zofe.fr/uploads/1/3/0/6/130604543/c06910657b61.pdfIn PDF document text
    • http://studioorchidee.services/uploads/1/3/0/4/130483804/dibeworunexa_vituxenijabu_juzidi_gerodoza.pdfIn PDF document text
    • http://mildlymannered.com/uploads/1/3/0/4/130436154/fasaxixapo.pdfIn PDF document text
    • http://www.sarahsscentscentral.co.uk/uploads/1/3/0/5/130543025/8569594.pdfIn PDF document text
    • http://asylum.institute/uploads/1/3/0/5/130589231/6776025.pdfIn PDF document text
    • http://mychildrendevelopment.com/uploads/1/3/0/8/130813111/7636338.pdfIn PDF document text
    • http://ndlobmac.com/uploads/1/3/0/6/130621370/jitatufadejajupuv.pdfIn PDF document text
    • http://cairokhanhotel.net/uploads/1/3/0/5/130550997/8104590.pdfIn PDF document text
    • http://youdrivemetodrink.net/uploads/1/3/0/8/130814642/098526dae2c9309.pdfIn PDF document text
    • http://modelsenden.com/uploads/1/3/0/5/130539255/4050162.pdfIn PDF document text
    • http://pressurewashingtorrance.com/uploads/1/3/0/6/130603927/dinufan.pdfIn PDF document text
    • http://arabellaboutiqueofnmb.com/uploads/1/3/0/8/130873955/7819626.pdfIn PDF document text
    • http://washingtonmatters.com/uploads/1/3/0/6/130639224/tiwapitu-pasaso.pdfIn PDF document text
    • http://tannerromleski.com/uploads/1/3/0/6/130605438/145aaf276.pdfIn PDF document text
    • http://adsl-63-204-18-10.benefitplans.org/uploads/1/3/0/3/130313170/130313170.html#abs+cbn+tv+plus+channels+list+tv5In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ee5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EE5 16200 bytes
SHA-256: 83d8dc4198459458918f4a16f539f779d1dd276ab42844e68f4b5af54491fe71
font_01_sfnt_off00005714.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5714 8100 bytes
SHA-256: 8ada140586968dae3d4b541ce69fc669a8bdbcb98705eb667ae2ac9c9efcf8af

Open this report in the interactive analyzer, or submit your own file for analysis.