Malicious PDF — malware analysis report

Static analysis result for SHA-256 84c810dbfaa479e5…

MALICIOUS

PDF

47.5 KB Authoring application: Solid Converter PDF First seen: 2026-05-08
MD5: 94c0381a772bacd3b9356d59621c3683 SHA-1: b90f203d9de6209c8495a55e99a91980408ecb9e SHA-256: 84c810dbfaa479e59f6a921600a31eb3cbbb7fb893d99d15262cadbb67bd1fae
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content, likely phishing or malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fisotev.parfumsoo.ru/uploads/2020/01/28/7593222.pdf In PDF document text
    • https://tivagokazoganix.weebly.com/uploads/1/3/0/2/130271244/nuxuporofagav.pdfIn PDF document text
    • https://vazuseroruwun.weebly.com/uploads/1/3/0/3/130379067/zavijewixafomoreta.pdfIn PDF document text
    • http://blacklines.org/uploads/1/3/0/5/130550768/4420479.pdfIn PDF document text
    • http://themayacentre.org/uploads/1/3/0/4/130489331/2429308.pdfIn PDF document text
    • http://your-website.name/uploads/2020/01/29/bogowuraruxixi.pdfIn PDF document text
    • http://sharkdesarrollos.com/uploads/2020/01/27/82cc8a.pdfIn PDF document text
    • http://schanwriter.com/uploads/1/3/0/6/130604078/4cfc90405a38bfe.pdfIn PDF document text
    • http://loxo.my-blogonline.ru/uploads/2020/01/28/nisum.pdfIn PDF document text
    • http://krystalshark.ru/uploads/2020/01/27/4467972.pdfIn PDF document text
    • http://oncobiotek.com/uploads/1/3/0/2/130272102/maxivo.pdfIn PDF document text
    • http://95.217.124.70:80/uploads/2020/01/28/narazosax_dazezot.pdfPDF link annotation
    • http://lbjconsult.com/uploads/1/3/0/6/130621859/8891906.pdfIn PDF document text
    • http://blondiau.org/uploads/1/3/0/4/130488338/fezukawugop.pdfIn PDF document text
    • http://aventusinflatables.com/uploads/1/3/0/5/130551362/7828431.pdfIn PDF document text
    • http://kexig.rusfermer.info/uploads/2020/01/27/7914309.pdfIn PDF document text
    • http://niforov.2elalanadialsat.com/uploads/2020/01/29/3429389c37f8d.pdfIn PDF document text
    • http://lightfastdesign.com/uploads/1/3/0/3/130324152/dc8b7ad84a.pdfIn PDF document text
    • http://resiliencepsychotherapy.com/uploads/1/3/0/6/130604778/wajepatofi-weweji-bugifapizoziga.pdfIn PDF document text
    • http://littlebsbigdesigns.com/uploads/1/3/0/6/130603808/7046307.pdfIn PDF document text
    • http://color4home.com/uploads/1/3/0/5/130540592/130540592.html#businessman+movie+songs++in+hdIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E5 9000 bytes
SHA-256: 1e0d644b44059f2c101ee10eed46cf0742a15b068db31ff6eae7614fd4c3341f
font_01_sfnt_off000071f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71F2 16336 bytes
SHA-256: 101447ec0f1ff9a166538e0d663148276e3a4fc1aded7589db46e8db93931e1f

Open this report in the interactive analyzer, or submit your own file for analysis.