Malicious PDF — malware analysis report

Static analysis result for SHA-256 81ad34733e6666b3…

MALICIOUS

PDF

44.3 KB Authoring application: LibreOffice First seen: 2026-05-09
MD5: 9d945934abfac53e6a73ddb1090de71f SHA-1: 21b862aa5d7bd6d13d8d220196c74237f420e401 SHA-256: 81ad34733e6666b3b823a2bdfa4a8a25e4ceb746b15864aabfc0ce235ee9a2a7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tuvanduhocanh.com/uploads/1/3/0/8/130813553/tuxubi.pdf In PDF document text
    • http://wag-works.com/uploads/1/3/0/4/130483583/a5ce31.pdfIn PDF document text
    • http://caitlindoula.com/uploads/1/3/0/5/130588964/1684885.pdfIn PDF document text
    • http://designwebframe.com/uploads/1/3/0/6/130620563/5018361.pdfIn PDF document text
    • http://more-beautiful.com/uploads/1/3/0/7/130739020/8871970.pdfIn PDF document text
    • http://woodruffshomeimprovements.net/uploads/1/3/0/5/130540017/puvojudedu.pdfIn PDF document text
    • http://cubalibrecasino.com/uploads/1/3/0/5/130550857/8192049.pdfIn PDF document text
    • http://drjamesworling.net/uploads/1/3/0/6/130605194/683692.pdfIn PDF document text
    • http://luxury-travel-shop.com/uploads/1/3/0/8/130874386/7854a9.pdfIn PDF document text
    • http://lianefong.com/uploads/1/3/0/6/130621025/2ea789f.pdfIn PDF document text
    • http://www.advancespinerehab.com/uploads/1/3/0/4/130483045/8715820.pdfIn PDF document text
    • http://dovernewlife.org/uploads/1/3/0/7/130776218/zurusazak.pdfIn PDF document text
    • http://appwirestudios.com/uploads/1/3/0/6/130621800/xoxixen.pdfIn PDF document text
    • http://webdisk.suisekirocks.com/uploads/1/3/0/8/130873848/xeloz.pdfIn PDF document text
    • http://bayareabackdoc.com/uploads/1/3/0/3/130323900/7639950.pdfIn PDF document text
    • http://lifeisdata.net/uploads/1/3/0/6/130603956/5518403.pdfIn PDF document text
    • http://www.stocktontljsoccer.com/uploads/1/3/0/2/130289653/9906834.pdfIn PDF document text
    • http://facultynewyork.com/uploads/1/3/0/6/130620981/viruzudisa.pdfIn PDF document text
    • http://safecitysecurity.com/uploads/1/3/0/3/130323311/mawivitekobozewuwel.pdfIn PDF document text
    • http://arlingtoncarpetcleaner.com/uploads/1/3/0/6/130621031/bowoxomuzax.pdfIn PDF document text
    • http://mail.schoolofrespect.com/uploads/1/3/0/2/130272280/518522c8b68.pdfIn PDF document text
    • http://walterwanderley.com/uploads/1/3/0/4/130476513/9137024.pdfIn PDF document text
    • http://a6d.com/uploads/1/3/0/3/130323727/2f0c95b86342db.pdfIn PDF document text
    • http://mail.redcientificaescolar.com/uploads/1/3/0/6/130620979/wirafe-vaweg.pdfIn PDF document text
    • http://noahcompportfolio.com/uploads/1/3/0/6/130639889/7594b4cc021ae.pdfIn PDF document text
    • http://churchstrettontaxi.com/uploads/1/3/0/5/130544257/130544257.html#algal+microbial+fuel+cellIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000480b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x480B 8644 bytes
SHA-256: e61bd683adec1fbc251e333adfbda8b51d55850d0794589a9f1faf67d6581f7b

Open this report in the interactive analyzer, or submit your own file for analysis.