Malicious PDF — malware analysis report

Static analysis result for SHA-256 835699efd15c3b39…

MALICIOUS

PDF

39.2 KB Authoring application: PDF Studio First seen: 2026-05-09
MD5: cba14b3060790b42c531ba827ad97a51 SHA-1: 361171a3409dc2ba03864abc0a85820c0760faf0 SHA-256: 835699efd15c3b39081b66fa50d74b1bd99a6c26b13a5f1aa849cb91fd0292ee
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by multiple heuristics, including a critical finding for a link farm containing 31 external PDF links. The ML classifier also strongly indicated maliciousness. The embedded URLs likely serve as a lure to redirect users to malicious content or phishing sites, consistent with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mynormanrockwell.org/uploads/1/3/0/7/130738764/7103367.pdf In PDF document text
    • http://weedeaterridinglawnmower.net/uploads/1/3/0/5/130588931/lujivekupome_rojajo_dajadesasa_buniwe.pdfIn PDF document text
    • http://serbaballet.com/uploads/1/3/0/5/130589308/3889883.pdfIn PDF document text
    • http://clevelandtoybox.com/uploads/1/3/0/6/130620491/18be394.pdfIn PDF document text
    • http://a100radio.com/uploads/1/3/0/7/130776458/3d8b8b7.pdfIn PDF document text
    • http://www.lindonsamgroup.com/uploads/1/3/0/3/130323979/teboximisuregonuni.pdfIn PDF document text
    • http://nationalcasinomarketing.com/uploads/1/3/0/2/130289305/xukote_povegineviv_latedabudadakit.pdfIn PDF document text
    • http://www.wigandweavehair.com/uploads/1/3/0/2/130289319/tagez_remebeduba_gasanuja.pdfIn PDF document text
    • http://laudatemariam.com/uploads/1/3/0/6/130605030/nopetasejonumujerezu.pdfIn PDF document text
    • http://kraimgroup.com/uploads/1/3/0/5/130550749/5025690.pdfIn PDF document text
    • http://www.dannorrisdesigns.com/uploads/1/3/0/4/130483492/majame.pdfIn PDF document text
    • http://proplacementsza.com/uploads/1/3/0/4/130483679/4364ebfc6654.pdfIn PDF document text
    • http://mafamillecenla.net/uploads/1/3/0/5/130546519/bajuwagiti.pdfIn PDF document text
    • http://beyondhillco.com/uploads/1/3/0/2/130289458/fazepidiladugiwufiji.pdfIn PDF document text
    • http://mold-a-rama.net/uploads/1/3/0/2/130272610/vebulegokaxak-sireditele-wusixan.pdfIn PDF document text
    • http://flykingzcollection.com/uploads/1/3/0/7/130738512/dufufi-losaxelalum-jerujevofof-kaketugobutukid.pdfIn PDF document text
    • http://absoluteventoparty.com/uploads/1/3/0/5/130541817/lunegilazexikolujixo.pdfIn PDF document text
    • http://newcovenantinspections.com/uploads/1/3/0/7/130776241/dinigezusosobu-kedetiwapul.pdfIn PDF document text
    • http://thel14.com/uploads/1/3/0/5/130590059/gegupotul.pdfIn PDF document text
    • http://bananacovers.com/uploads/1/3/0/6/130604176/810790.pdfIn PDF document text
    • http://buffalobubbletea.com/uploads/1/3/0/7/130738641/0aa1a.pdfIn PDF document text
    • http://laknaholdings.net/uploads/1/3/0/5/130588396/rifikubuso_babumebi_molofisikisa.pdfIn PDF document text
    • http://wileybrands.com/uploads/1/3/0/8/130874220/1584304.pdfIn PDF document text
    • http://down-the-block.com/uploads/1/3/0/7/130739126/7857006.pdfIn PDF document text
    • http://karmoinmobiliaria.com/uploads/1/3/0/2/130287538/4591742.pdfIn PDF document text
    • http://hemphealthapothecary.com/uploads/1/3/0/7/130740213/130740213.html#phosphate+buffered+saline+preparation+ph+7.4In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000344a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x344A 7952 bytes
SHA-256: 8537416351ae5e115d28aaaa0491f78c152d80c2795d4194b4a874add40b680c

Open this report in the interactive analyzer, or submit your own file for analysis.