Malicious PDF — malware analysis report

Static analysis result for SHA-256 27e1df44e526db40…

MALICIOUS

PDF

39.8 KB Authoring application: Smallpdf Desktop First seen: 2026-05-08
MD5: 2ecc0b22c517b4d894095e5d510c2817 SHA-1: 33c285c99292d2d842176dbc491f15457348588e SHA-256: 27e1df44e526db4095400bffbd4f2ba00c7abc1b37804235a7c3caaa7bef59f5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall, and a critical heuristic detected a PDF link farm. The document body contains nonsensical text mixed with what appears to be a lure related to STI transmission, further suggesting a deceptive purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ruralfaith.com/uploads/1/3/0/2/130289655/d2f9d899a.pdf In PDF document text
    • http://discoveryschoolsmo.com/uploads/1/3/0/2/130274258/busel_vovadaxug_lasenivililapa_fujaxazex.pdfIn PDF document text
    • http://ubezpieczenia-czestochowa.eu/uploads/1/3/0/6/130605072/2750120.pdfIn PDF document text
    • http://nawahte.com/uploads/1/3/0/6/130639687/jafokajasataku-bosuxixa-rarilitan-xuzuw.pdfIn PDF document text
    • http://mycleanohio.com/uploads/1/3/0/6/130639959/jojijarobexugaf_xijuxanutevabu.pdfIn PDF document text
    • http://yourorganizedplace.com/uploads/1/3/0/6/130621033/kameto-xinej-zumaxaxusemiwil.pdfIn PDF document text
    • http://carrieminter.net/uploads/1/3/0/2/130271207/d0f13a.pdfIn PDF document text
    • http://oddher.com/uploads/1/3/0/7/130776100/lofovim-rebabigik.pdfIn PDF document text
    • http://previewclass.com/uploads/1/3/0/6/130639948/1495444.pdfIn PDF document text
    • http://hostmaster.robertholmesguitars.co.uk/uploads/1/3/0/7/130776502/buvepuleraxubafazu.pdfIn PDF document text
    • http://www.alexanderjdee.com/uploads/1/3/0/6/130604501/kajajogodag.pdfIn PDF document text
    • http://wadsworthpersonalinjury.com/uploads/1/3/0/7/130775271/xakobonalom.pdfIn PDF document text
    • http://baronyofthelonelytower.org/uploads/1/3/0/6/130640116/gajulajeroxot.pdfIn PDF document text
    • http://allthingsluxeboutique.com/uploads/1/3/0/6/130639236/6453517.pdfIn PDF document text
    • http://musicstockphoto.com/uploads/1/3/0/3/130323568/5946424.pdfIn PDF document text
    • http://bearcompany.com/uploads/1/3/0/6/130621552/11e51.pdfIn PDF document text
    • http://worldinbloom.org/uploads/1/3/0/7/130739437/0d4bf0ca4.pdfIn PDF document text
    • http://mjeportfolios.com/uploads/1/3/0/3/130313504/841234.pdfIn PDF document text
    • http://thehypnopy.com/uploads/1/3/0/6/130620899/a4fa8161e23e4ce.pdfIn PDF document text
    • http://lucasgarron.net/uploads/1/3/0/3/130313504/wejasu.pdfIn PDF document text
    • http://mail.shuoacademy.com/uploads/1/3/0/6/130604977/gisovajax_wanedikabejepix.pdfIn PDF document text
    • http://mechapocalypse.org/uploads/1/3/0/2/130274017/53a6e0.pdfIn PDF document text
    • http://latriboo.com/uploads/1/3/0/5/130544754/68500d5cd465.pdfIn PDF document text
    • http://host90.carmichaelnl.com/uploads/1/3/0/7/130739711/130739711.html#chlamydia+transmission+non+sexuallyIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AE4 7268 bytes
SHA-256: 08b34b6a5a8d101dff3f7ddb9070453b2e8cc85bf7da5aafb38d0065209220b6

Open this report in the interactive analyzer, or submit your own file for analysis.