Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6e7d55e7e6dc8e0…

MALICIOUS

PDF

41.3 KB Authoring application: GIMP First seen: 2026-05-07
MD5: 034e7b4dfe8d11e2b587b3a1257e7802 SHA-1: b7af583b0eeadef0541ece390da8a9abecb1e768 SHA-256: a6e7d55e7e6dc8e074bc567bcec7e4ee6455534590772c2359ccdf429ea9c213
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files hosted on various domains, indicating a link farm or redirection strategy. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and ML classification strongly supports maliciousness. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for SEO manipulation or to serve as a distribution point for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://infinitespinners.com/uploads/1/3/0/7/130776103/sukejon-didurub-kojeb.pdf In PDF document text
    • http://windowssavvy.com/uploads/1/3/0/2/130271043/0233ef6770cfb1.pdfIn PDF document text
    • http://doublekdorpersheepranch.com/uploads/1/3/0/6/130621507/051b010b4.pdfIn PDF document text
    • http://cocorosaemporium.net/uploads/1/3/0/4/130488328/5828396.pdfIn PDF document text
    • http://thescoreshop.ca/uploads/1/3/0/3/130323178/8458357.pdfIn PDF document text
    • http://scarlettsloanewalling.com/uploads/1/3/0/7/130776673/3240675.pdfIn PDF document text
    • http://warwickcarriagedriving.com/uploads/1/3/0/2/130272892/ee724fe8b.pdfIn PDF document text
    • http://tqcontentcrusader.com/uploads/1/3/0/2/130291635/wujemugewutu.pdfIn PDF document text
    • http://aquariumboss.com/uploads/1/3/0/7/130775572/muvupunatoropadobeju.pdfIn PDF document text
    • http://edengiftco.com/uploads/1/3/0/5/130539078/43336a3da9.pdfIn PDF document text
    • http://caninecocktailpawty.com/uploads/1/3/0/5/130551235/vigurulabeg-walolaxejolasip-gidenup.pdfIn PDF document text
    • http://webmail.tambourunite.com/uploads/1/3/0/2/130271240/govoxekakujebareruke.pdfIn PDF document text
    • http://equineartworks.com/uploads/1/3/0/2/130272318/gekafunifotoretazi.pdfIn PDF document text
    • http://www.phecurrency.com/uploads/1/3/0/3/130313198/9782693.pdfIn PDF document text
    • http://luxseek.com/uploads/1/3/0/7/130738970/pabifebinis.pdfIn PDF document text
    • http://lilyspadpetcare.com/uploads/1/3/0/3/130313638/rosar_tixazadufojaw_jematidibede.pdfIn PDF document text
    • http://themountainforge.com/uploads/1/3/0/7/130776541/1d1952f.pdfIn PDF document text
    • http://shot-sleeves.com/uploads/1/3/0/7/130739124/7aeac1ba.pdfIn PDF document text
    • http://experiencemeaning.com/uploads/1/3/0/2/130289485/6838331.pdfIn PDF document text
    • http://msbr.ca/uploads/1/3/0/4/130436367/solopezo-faxawemazojufas-kelukamadepipa.pdfIn PDF document text
    • http://bozhidaoyulechengguanwang.br3h.com/uploads/1/3/0/4/130483576/130483576.html#atkins+diet+breakfast+cerealIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004099.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4099 8396 bytes
SHA-256: ddfa53f58a5fc987f92351b73b41da3c8c8da3f78e0567b483930a79cb42fdeb

Open this report in the interactive analyzer, or submit your own file for analysis.