Malicious PDF — malware analysis report

Static analysis result for SHA-256 884013a758b4d7d3…

MALICIOUS

PDF

51.6 KB Authoring application: Mobipocket Creator First seen: 2026-05-08
MD5: 308aaa398b2fbc8e583e5eed6779fa34 SHA-1: 042123fc95e031147c4e0bc135ec4850df3b139f SHA-256: 884013a758b4d7d355e9726fc6e97beef97dbdc673c3d1c41119a0b88239db03
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1539 Steal or Harvest Session Tokens

The PDF contains a large number of embedded URLs, forming a link farm, and is flagged by multiple heuristics as malicious and a credential harvesting lure. The document body, though heavily obfuscated, contains text related to changing a 'base package' and 'Airtel Digital TV packs', suggesting a lure related to service changes or account management. The embedded URLs likely lead to phishing pages designed to steal user credentials or session tokens.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chitowngala.com/uploads/1/3/0/7/130776649/9589576.pdf In PDF document text
    • http://abogadospluralistas.org/uploads/1/3/0/7/130740573/1778803.pdfIn PDF document text
    • http://brettcross.net/uploads/1/3/0/6/130639531/8143741.pdfIn PDF document text
    • http://cupcakecomeback.com/uploads/1/3/0/5/130588780/7360085.pdfIn PDF document text
    • http://www.jaymichaelgilman.com/uploads/1/3/0/7/130738892/pumosoxi_tosoneve.pdfIn PDF document text
    • http://root.h-a-r-t.org/uploads/1/3/0/7/130776164/ridageba-kukoseb-dapopavelawubag.pdfIn PDF document text
    • http://www.easeupyourlife.com/uploads/1/3/0/7/130775331/2b9dfa.pdfIn PDF document text
    • http://minhavidaminhasescolhas.com/uploads/1/3/0/2/130272254/jomukawaz_xewimunom.pdfIn PDF document text
    • http://dvvap.org/uploads/1/3/0/4/130489019/1856561.pdfIn PDF document text
    • http://mx.kammcreekfarm.com/uploads/1/3/0/6/130639611/rorep_mufokabalaj.pdfIn PDF document text
    • http://whymegandoonan.com/uploads/1/3/0/3/130379061/2178261.pdfIn PDF document text
    • http://mail.stop-roken-coach.nl/uploads/1/3/0/5/130590763/newiluditixe.pdfIn PDF document text
    • http://mta-sts.mail.ibew23.org/uploads/1/3/0/2/130288630/genafidilebipok.pdfIn PDF document text
    • http://mail.jessicamiyuki.com/uploads/1/3/0/5/130544257/sazefewuso-folibatixovofon-nerenevipeje-zililejeju.pdfIn PDF document text
    • http://bubblesoccergeelong.com.au/uploads/1/3/0/7/130738778/d33f2.pdfIn PDF document text
    • http://christianefontaine.com/uploads/1/3/0/5/130539113/613735.pdfIn PDF document text
    • http://sportskidsplay.com/uploads/1/3/0/5/130588787/wirememok.pdfIn PDF document text
    • http://www.muhammadsrsabry.us/uploads/1/3/0/6/130604177/xumedojesagadax.pdfIn PDF document text
    • http://mahgdalenrose.com/uploads/1/3/0/2/130271154/rufulefumasotudorapi.pdfIn PDF document text
    • http://nelslehtinen.com/uploads/1/3/0/5/130550827/9211fc9b.pdfIn PDF document text
    • http://pbjconstructionllc.com/uploads/1/3/0/3/130313836/130313836.html#airtel+dth+change+base+packageIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005058.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5058 16164 bytes
SHA-256: 32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56
font_01_sfnt_off0000686e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x686E 8760 bytes
SHA-256: dcc06d952967721f420b69aa0fd14c2c1aa73c1ca76b35515ae84b7d6713c2e0

Open this report in the interactive analyzer, or submit your own file for analysis.