Malicious PDF — malware analysis report

Static analysis result for SHA-256 9146fc15744722aa…

MALICIOUS

PDF

41.5 KB Authoring application: Inkscape First seen: 2026-05-09
MD5: f39d856ee7c0d7dd7ec0220f0fb700c5 SHA-1: 13922de30dfbfa85f0e7b185a82406647324d864 SHA-256: 9146fc15744722aadabd5a0b4b0ed9fdd4490bd092bd06cf2641f78c9e6ffdfa
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body text, though partially corrupted, mentions 'Agricola rules pdf' and includes what appears to be a call-to-action, aligning with a lure to download or view content via the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://riddlefamilyranchgrassfedbeef.com/uploads/1/3/0/6/130603748/1058335.pdf In PDF document text
    • http://chrislockett.com/uploads/1/3/0/6/130604582/8335f.pdfIn PDF document text
    • http://jikuna.specodegda-kemerovo.ru/uploads/2020/01/27/vinud-rofajak-sumejavaxok.pdfIn PDF document text
    • http://papa.mojenmoney.xyz/uploads/2020/01/29/mogobofavitex.pdfIn PDF document text
    • http://nakivumofi.monplezir.su/uploads/2020/01/28/7ca8f.pdfIn PDF document text
    • http://msemmashairgrowth.com/uploads/1/3/0/6/130621576/1580907.pdfIn PDF document text
    • http://thisisallisonlee.com/uploads/1/3/0/2/130271234/36f182f2.pdfIn PDF document text
    • http://advance-it.net/uploads/1/3/0/3/130323106/130323106.html#agricola+rules+pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001156.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1156 8592 bytes
SHA-256: f0aa4b656c310de6d1b600c2ba8a46a9b801bd00a6aa4a83b299105fe1ee825a
font_01_sfnt_off00006724.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6724 2696 bytes
SHA-256: a37238489f74aeb7a9cbcc50e21dce70ebe3d03fd0acfa0fa0165a1d5efbf8dc

Open this report in the interactive analyzer, or submit your own file for analysis.