Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c240a812f950a0c…

MALICIOUS

PDF

40.7 KB Authoring application: ImageMagick First seen: 2026-05-09
MD5: abe830afaf530731938efaf1fc4a62cc SHA-1: 59b0efba7a6cc473a52c6767410100f0dbf34267 SHA-256: 1c240a812f950a0c1e4249581f969fd48fc15ff636f4361d9f07b39b6bb7dfe5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or redirection campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lexgurst.com/uploads/1/3/0/5/130551727/genomi-rumujofaz.pdf In PDF document text
    • http://nh-dreamhomes.com/uploads/1/3/0/7/130738972/kemizonakopedu.pdfIn PDF document text
    • http://www.shopsuper-nova.com/uploads/1/3/0/5/130541424/4415272.pdfIn PDF document text
    • http://shannondriscol.com/uploads/1/3/0/6/130604812/53721.pdfIn PDF document text
    • http://www.tacaccountants.com/uploads/1/3/0/7/130738639/busaxufepez_rixilu_razaj.pdfIn PDF document text
    • http://www.uem-iee.org/uploads/1/3/0/6/130620555/kupare.pdfIn PDF document text
    • http://www.usairborneforces.net/uploads/1/3/0/5/130589070/5111478.pdfIn PDF document text
    • http://deltagoldoffer.com/uploads/1/3/0/8/130813427/menakeboregelewoz.pdfIn PDF document text
    • http://usedforklifttrucks.org/uploads/1/3/0/2/130272388/a0134263.pdfIn PDF document text
    • http://swingcityvolleyball.com/uploads/1/3/0/8/130874474/471d64772a91a.pdfIn PDF document text
    • http://12utct.com/uploads/1/3/0/6/130620957/b3aff92ead5.pdfIn PDF document text
    • http://eugeneylee.com/uploads/1/3/0/2/130273738/7999509.pdfIn PDF document text
    • http://routre.com/uploads/1/3/0/7/130775762/d201c904847.pdfIn PDF document text
    • http://lingeriestoresplano.net/uploads/1/3/0/5/130590265/810035.pdfIn PDF document text
    • http://link2yoo.net/uploads/1/3/0/6/130639765/5222868.pdfIn PDF document text
    • http://catchnrelease.org/uploads/1/3/0/7/130776076/pixunejotibanojifusa.pdfIn PDF document text
    • http://chitchatchan.com/uploads/1/3/0/6/130621187/740166.pdfIn PDF document text
    • http://natationlaval.com/uploads/1/3/0/5/130539185/nusurikikula.pdfIn PDF document text
    • http://vapeeco.com/uploads/1/3/0/5/130542977/aca2fb29f17.pdfIn PDF document text
    • http://rsllcw.com/uploads/1/3/0/5/130550772/fazakomuwewonoj.pdfIn PDF document text
    • http://k9recreation.com/uploads/1/3/0/7/130775031/3389338.pdfIn PDF document text
    • http://tuxebase.com/uploads/1/3/0/7/130776503/nubagagasi.pdfIn PDF document text
    • http://irisdealsourcing.co.uk/uploads/1/3/0/6/130640021/xuwefagabaz-wurunifizur-fadejogaw-raduwotoz.pdfIn PDF document text
    • http://taxauctiontitle.com/uploads/1/3/0/3/130313053/ritilaxefopunad.pdfIn PDF document text
    • http://mortgageskout.com/uploads/1/3/0/2/130289535/1059506.pdfIn PDF document text
    • http://chloral21.pleasingfood.com/uploads/1/3/0/6/130603710/130603710.html#endometrial+cancer+staging+radiographicsIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ecd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2ECD 2600 bytes
SHA-256: 41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee
font_01_sfnt_off00003a51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A51 8000 bytes
SHA-256: da4288872d9254e751a4e8dea9787c661170823a42ef76a079bb2cdbc8334db8

Open this report in the interactive analyzer, or submit your own file for analysis.