Malicious PDF — malware analysis report

Static analysis result for SHA-256 814cd7c9b0eefa3d…

MALICIOUS

PDF

43.6 KB Authoring application: Adobe PDF Library 9.0 First seen: 2026-05-09
MD5: de7de58321035739deb53aa878e52635 SHA-1: 8f22b2a309a895c0394c3a88e00c243538bcf3d7 SHA-256: 814cd7c9b0eefa3db40f9f77289d5129f9c51c81bc0035c897c417fcd4fedba0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing 25 external PDF links. The ML classifier also strongly indicated maliciousness. The embedded URLs suggest a phishing or SEO manipulation tactic, likely intended to redirect users to malicious content or further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tripandsip.org/uploads/1/3/0/3/130379529/nukugevewutobuwiwire.pdf In PDF document text
    • http://nxlevelphysicaltherapy.com/uploads/1/3/0/7/130740200/xedosiwosib.pdfIn PDF document text
    • http://santafecouncil.com/uploads/1/3/0/3/130379158/leludelekibirabef.pdfIn PDF document text
    • http://transcendence.community/uploads/1/3/0/3/130379777/9a95ee60af9.pdfIn PDF document text
    • http://nicholasreinhartpresents.com/uploads/1/3/0/8/130813381/vupimeb.pdfIn PDF document text
    • http://gcheavenlycleaning.services/uploads/1/3/0/8/130873994/8909260.pdfIn PDF document text
    • http://apslabgroup.com/uploads/1/3/0/2/130272613/48b45bb3fbac.pdfIn PDF document text
    • http://epicureanolives.com/uploads/1/3/0/4/130483122/mevuj.pdfIn PDF document text
    • http://hqafertilitycenter.com/uploads/1/3/0/9/130969707/db6cb.pdfIn PDF document text
    • http://hostmaster.mariag.de/uploads/1/3/0/7/130740393/foxusok_jukolijafa.pdfIn PDF document text
    • http://www.libongku.com/uploads/1/3/0/7/130739577/zofazetexepabik-taxobutimevo.pdfIn PDF document text
    • http://www.2blesseddesign.com/uploads/1/3/0/3/130379522/jijafabetemozurez.pdfIn PDF document text
    • http://teacupsanddresses.com/uploads/1/3/0/5/130544938/403342.pdfIn PDF document text
    • http://myjessiereyez.com/uploads/1/3/0/6/130639350/dejomokadibevonuxet.pdfIn PDF document text
    • http://erlamb.com/uploads/1/3/0/2/130272482/limotumafe.pdfIn PDF document text
    • http://www.peefog.com/uploads/1/3/0/6/130621826/sezumegividorugip.pdfIn PDF document text
    • http://www.firstpressiloam.com/uploads/1/3/0/7/130739140/tovufamelepeb.pdfIn PDF document text
    • http://kokuasupport.org/uploads/1/3/0/2/130289719/0b524dc39beb79.pdfIn PDF document text
    • http://wrcustomguitars.net/uploads/1/3/0/5/130550881/476d9ba252d62c.pdfIn PDF document text
    • http://hollisharred.com/uploads/1/3/0/6/130621376/goligofekotu.pdfIn PDF document text
    • http://nplfiles.com/uploads/1/3/0/7/130739256/2dbeccd0168c3fd.pdfIn PDF document text
    • http://huggyandcuddles.net/uploads/1/3/0/5/130551258/d9cd4802e145.pdfIn PDF document text
    • http://www.thekarmamoon.com/uploads/1/3/0/5/130590334/d0346f2a10b2c00.pdfIn PDF document text
    • http://jenniferlboyle.com/uploads/1/3/0/8/130874034/fuvux.pdfIn PDF document text
    • http://historyofconcerts.com/uploads/1/3/0/6/130639141/falukuku.pdfIn PDF document text
    • http://74-123-79-94.mgwnet.com/uploads/1/3/0/6/130621406/130621406.html#sentence+containing+prepositional+phraseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003024.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3024 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_01_sfnt_off00004712.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4712 7588 bytes
SHA-256: 7fc9b400be92475490d121a1a8b163ae6bf4a1052af172f3ef99969f75fcdf42

Open this report in the interactive analyzer, or submit your own file for analysis.