Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f1781059c962f21…

MALICIOUS

PDF

53.6 KB Authoring application: Karbon First seen: 2026-05-08
MD5: 6ed86dd6dce2f1eba5a4cbf0f80f1293 SHA-1: 52a7f81d02377778a0f179c1b610606cd29e67f3 SHA-256: 2f1781059c962f21c3c957ea5324ca44fd31e4e5232bd219b3b05335fac5e47a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded URLs, indicating a link farm designed to direct users to potentially malicious content. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior, suggesting the document's primary purpose is to facilitate phishing or malware distribution through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nojabavojigul.weebly.com/uploads/1/3/0/3/130379051/munal.pdf In PDF document text
    • http://diamondbabygems.com/uploads/1/3/0/6/130639750/4266396.pdfIn PDF document text
    • http://modosmedia.com/uploads/1/3/0/4/130476185/9962951.pdfIn PDF document text
    • http://kelownavacationseasonalrentals.com/uploads/1/3/0/4/130436121/b5f62a.pdfIn PDF document text
    • http://lilamomeg.myopros.tech/uploads/2020/01/27/c5109a114c7c5d.pdfIn PDF document text
    • http://heatherscustomcookies.com/uploads/1/3/0/6/130620224/wizakiw_wojelodezelufi_pulifi.pdfIn PDF document text
    • http://10thirtychoir.org/uploads/1/3/0/3/130324419/7942659.pdfIn PDF document text
    • https://kisozebiduz.weebly.com/uploads/1/3/0/5/130589019/rukosofuledilegos.pdfIn PDF document text
    • http://keepamericatrumpfree.com/uploads/1/3/0/4/130476786/sukeroxanufukak_xeguwuni.pdfIn PDF document text
    • http://shopcenter16.fun/uploads/2020/01/28/3505151.pdfIn PDF document text
    • http://kelufu.aseralle.me/uploads/2020/01/29/7008931.pdfIn PDF document text
    • http://laurencegestalt.com/uploads/1/3/0/2/130272234/sijokegofokenuvilom.pdfIn PDF document text
    • http://mrscooke.com/uploads/1/3/0/3/130313541/2756017.pdfIn PDF document text
    • http://bodyworkbybarb.com/uploads/1/3/0/2/130271098/130271098.html#dibels+8th+edition+lausdIn PDF document text
🗂 Part of campaign: 10thirtychoir.org 3 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001156.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1156 9232 bytes
SHA-256: 2d6ba1d0c20742e5f7a4c943629566d9a26cdffc65b18080a14f7e99a708eeba

Open this report in the interactive analyzer, or submit your own file for analysis.