Malicious PDF — malware analysis report

Static analysis result for SHA-256 7503b9e2c89d29b1…

MALICIOUS

PDF

53.3 KB Authoring application: pdf-parser First seen: 2026-05-07
MD5: 0df1ead99f6c7bbe53fe77a6427682c4 SHA-1: c5a5fd46943b605e5ed5cac3193d1ead4e71a5ec SHA-256: 7503b9e2c89d29b1ff217a175e871e253d7bba8aba681aa7fede82bb8fc0154f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary function appears to be acting as a gateway to a network of linked malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://salaamfundraiser.com/uploads/1/3/0/6/130605331/balabivaxexum-biwosimoxuwaz-kojexunetedeb.pdf In PDF document text
    • http://conquernorthwest.com/uploads/1/3/0/3/130313271/e456cd3.pdfIn PDF document text
    • http://www.urmomcast.com/uploads/1/3/0/4/130483592/nadoxojavuvi_polerujikewi_wigepa_webufupin.pdfIn PDF document text
    • http://nastynotfound.com/uploads/1/3/0/5/130550961/sowegukesividi.pdfIn PDF document text
    • http://beyondthehardwood.org/uploads/1/3/0/3/130379319/2f6724944e9.pdfIn PDF document text
    • http://74-123-76-172.mgwnet.com/uploads/1/3/0/9/130969936/lupawiderosodusonu.pdfIn PDF document text
    • http://lpsintranet.com/uploads/1/3/0/5/130551714/8907571.pdfIn PDF document text
    • http://waggintailsadrian.com/uploads/1/3/0/9/130969218/xoxaxudexili.pdfIn PDF document text
    • http://michaelsheacounselling.com/uploads/1/3/0/8/130874324/nawuxufevuz.pdfIn PDF document text
    • http://www.southbeltongt.net/uploads/1/3/0/7/130739746/8701541.pdfIn PDF document text
    • http://poolsidenorthshore.com/uploads/1/3/0/4/130476427/1d30451b4.pdfIn PDF document text
    • http://mirageestates.com/uploads/1/3/0/3/130323328/4422498.pdfIn PDF document text
    • http://mlhas.com/uploads/1/3/0/6/130640219/koxujumakikibuf-wavusapum.pdfIn PDF document text
    • http://discoveridyllwild.com/uploads/1/3/0/5/130540116/mabegoxelaborowolo.pdfIn PDF document text
    • http://www.norweldstress.ca/uploads/1/3/0/8/130873986/ee61cdd2b6b5d15.pdfIn PDF document text
    • http://museumeats.com/uploads/1/3/0/7/130738499/4707d3ff.pdfIn PDF document text
    • http://74-123-75-234.mgwnet.com/uploads/1/3/0/6/130640194/c102e016.pdfIn PDF document text
    • http://hospicehearts.org/uploads/1/3/0/2/130288458/6771889.pdfIn PDF document text
    • http://ns1.tonisenatore.com/uploads/1/3/0/5/130588267/2a1e892016a033.pdfIn PDF document text
    • http://mynastybath.com/uploads/1/3/0/7/130740609/1f27eb.pdfIn PDF document text
    • http://heysciences.us/uploads/1/3/0/5/130543743/4398168.pdfIn PDF document text
    • http://ext-web.drmarlenefarooq.com/uploads/1/3/0/3/130324170/c5bf033e24f3cd.pdfIn PDF document text
    • http://www.yulebacreekstockhorses.com/uploads/1/3/0/7/130776104/1114736.pdfIn PDF document text
    • http://sistim.biz/uploads/1/3/0/6/130604612/3092417.pdfIn PDF document text
    • http://www.mulberrystreetrecords.com/uploads/1/3/0/8/130814232/valetejudidakeb_lusel_todediwoves.pdfIn PDF document text
    • http://zuihaowanqipaiyouxi.br3h.com/uploads/1/3/0/7/130776648/130776648.html#testing+multiple+regression+assumptions+in+spssIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D6 8880 bytes
SHA-256: 994d475ff3bc0cde09d1d1f3580a4e7167a9ade761fbafdb892a176e440aaefd

Open this report in the interactive analyzer, or submit your own file for analysis.