Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d69c0f7ec89ba9b…

MALICIOUS

PDF

39.1 KB Authoring application: Adobe PDF Library 9.0 First seen: 2026-05-09
MD5: f9a9499fa7d39055134332349078b25c SHA-1: be7b139e0c4b7efc3199d06e0f7278737143846d SHA-256: 4d69c0f7ec89ba9b4950676c35f236e009e896f71f78db1d1c04ee055cc0eeed
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a phishing or SEO spam campaign. The SE_LOLBIN_RUN_COMMAND heuristic indicates the presence of instructions that could involve executing scripts or commands, potentially to download further payloads. The ClamAV detection further confirms its malicious nature as Pdf.Phishing.TtraffRobotInstall-7605656-0.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mossvalewellbeing.com/uploads/1/3/0/4/130436204/dojumapatewixomumago.pdf In PDF document text
    • http://spccmd.com/uploads/1/3/0/6/130604370/laxawom-wudabawuwapi-weropakumikak-viniwuled.pdfIn PDF document text
    • http://prometheanconcepts.net/uploads/1/3/0/4/130435787/9029105.pdfIn macro / runtime command snippet
    • http://thisisallisonlee.com/uploads/1/3/0/5/130588352/c70b04.pdfIn macro / runtime command snippet
    • http://mrsheridanenglish.com/uploads/1/3/0/7/130738964/4073546.pdfIn PDF document text
    • http://newlifeeastla.com/uploads/1/3/0/5/130539355/ec72c.pdfIn PDF document text
    • http://givingfair.org/uploads/1/3/0/5/130589040/wafabofadiganelob.pdfIn PDF document text
    • http://sparxelectricalcontractors.com/uploads/1/3/0/4/130477085/5367738.pdfIn PDF document text
    • http://ppmrktg.com/uploads/1/3/0/7/130740624/pujakeluk-babuvubawitezuw.pdfIn PDF document text
    • http://mountaincreeklodging.com/uploads/1/3/0/5/130546937/setubovagezitene.pdfIn PDF document text
    • http://peelsbackhoeservice.com/uploads/1/3/0/5/130539403/kumotikefazimafona.pdfIn PDF document text
    • http://bettergarages.com/uploads/1/3/0/6/130604949/molupibivuzoru_jadukut_sarozojo.pdfIn PDF document text
    • http://obhaw.net/uploads/1/3/0/4/130483578/6684125.pdfIn PDF document text
    • http://carpetcleanerwaukesha.com/uploads/1/3/0/4/130436058/ruzegivabamisokomu.pdfIn PDF document text
    • http://verrotech-status.com/uploads/1/3/0/6/130605036/darijosulanerawi.pdfIn PDF document text
    • http://aufstehen-gegen-linksfaschismus.org/uploads/1/3/0/3/130379604/vetilune-bazigap.pdfIn PDF document text
    • http://bedobecome.co/uploads/1/3/0/8/130874426/sixobasikizuwe.pdfIn PDF document text
    • http://adamsoilcompany.net/uploads/1/3/0/7/130776228/gamevewibotezoga.pdfIn PDF document text
    • http://alisondratpiano.com/uploads/1/3/0/7/130738792/dd776454dbaa16c.pdfIn PDF document text
    • http://belfastdrivered.com/uploads/1/3/0/6/130604757/petapanojaf.pdfIn PDF document text
    • http://numbersbeathunger.org/uploads/1/3/0/6/130621143/4a84f.pdfIn PDF document text
    • http://www.bdg.stronghandsenterprises.com/uploads/1/3/0/5/130543053/251b56.pdfIn PDF document text
    • http://tillercapitalltd.com/uploads/1/3/0/7/130738511/9fb08ceb5dd.pdfIn PDF document text
    • http://montrealbachelorweekend.com/uploads/1/3/0/5/130539370/nebilemajip.pdfIn PDF document text
    • http://citizenimmigrant.com/uploads/1/3/0/2/130291471/222673.pdfIn PDF document text
    • http://adsl-63-204-18-33.benefitplans.org/uploads/1/3/0/7/130776407/130776407.html#affirmations+louise+hay+self+loveIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33E1 8004 bytes
SHA-256: 641e1e77f25eebe0fd1e120156f1bbc5c45afa761a1cf287d38a4e8df5804f75

Open this report in the interactive analyzer, or submit your own file for analysis.