Malicious PDF — malware analysis report

Static analysis result for SHA-256 18af4e9757b0b4f5…

MALICIOUS

PDF

41.3 KB Authoring application: PDFedit First seen: 2026-05-08
MD5: 679124d42c5d66d7ecd9810cda0f8ed3 SHA-1: eef6e5152afa82b99a1618df57640282d07190d6 SHA-256: 18af4e9757b0b4f5d0513d1caaf08fe43ee8a5b209aa1df83cfb961e66255a86
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. Although no scripts were extracted, the sheer volume of external links suggests a coordinated effort to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail1.whatusee.co.za/uploads/1/3/0/5/130551264/333953.pdf In PDF document text
    • http://rebabowman.net/uploads/1/3/0/4/130491418/fitazu.pdfIn PDF document text
    • http://hidefdjs.com/uploads/1/3/0/3/130379803/5c773f.pdfIn PDF document text
    • http://namastebrown.com/uploads/1/3/0/6/130639661/modozapir.pdfIn PDF document text
    • http://unshakableyou.com/uploads/1/3/0/2/130271085/7311195.pdfIn PDF document text
    • http://www.herstatusquo.com/uploads/1/3/0/5/130543351/e208584f54.pdfIn PDF document text
    • http://diestrodecuerdas.com/uploads/1/3/0/2/130288939/35333522d.pdfIn PDF document text
    • http://absolutereductions.org/uploads/1/3/0/7/130739729/d6b0ce0670b1e14.pdfIn PDF document text
    • http://74-123-73-58.mgwnet.com/uploads/1/3/0/2/130272575/ledeligewugoxagi.pdfIn PDF document text
    • http://radtacular.net/uploads/1/3/0/5/130543154/zolomenikanozo_xebepotax_nenemukekof_lojur.pdfIn PDF document text
    • http://tekadocesgourmet.com/uploads/1/3/0/7/130776567/9628276.pdfIn PDF document text
    • http://medicalmalpracticegeorgia.com/uploads/1/3/0/7/130740217/e5d69d.pdfIn PDF document text
    • http://rejuvenationhealthcenter.net/uploads/1/3/0/2/130272616/midoxulusowu_povexuvowopu.pdfIn PDF document text
    • http://mrgroucho.com/uploads/1/3/0/2/130288661/jexiz.pdfIn PDF document text
    • http://iheartblue.org/uploads/1/3/0/6/130621306/lepopifo.pdfIn PDF document text
    • http://chickenland.net/uploads/1/3/0/2/130272577/5870148.pdfIn PDF document text
    • http://dearsilas.com/uploads/1/3/0/7/130775806/zokazevobezavep-safuwo-gifozula.pdfIn PDF document text
    • http://rentyourfbads.com/uploads/1/3/0/7/130738893/pupovaxurugi.pdfIn PDF document text
    • http://trondekyouthservices.com/uploads/1/3/0/5/130550887/wulupizujotebi_tujala.pdfIn PDF document text
    • http://lakebasinregion.org/uploads/1/3/0/6/130620628/315477d10d1d3.pdfIn PDF document text
    • http://mymorethan.com/uploads/1/3/0/4/130491253/a717be0b2e99.pdfIn PDF document text
    • http://nobleworkshumorcards.net/uploads/1/3/0/6/130605156/1271846.pdfIn PDF document text
    • http://acause2travel.org/uploads/1/3/0/3/130313150/3bc3fbc0c3a22c7.pdfIn PDF document text
    • http://musicoterapias.com/uploads/1/3/0/4/130488295/dumoxe.pdfIn PDF document text
    • http://taiyangchengjiawangbaosha.br3h.com/uploads/1/3/0/6/130640162/130640162.html#critical+path+float+and+slack+analysisIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000323d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x323D 1708 bytes
SHA-256: 83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086
font_01_sfnt_off00003d4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D4E 8080 bytes
SHA-256: 46b37923b095d735c4f8e15b8b626a44c36a423916c3db2a1f7d7937d3f85951

Open this report in the interactive analyzer, or submit your own file for analysis.