Malicious PDF — malware analysis report

Static analysis result for SHA-256 b21cf3b8edf50f0a…

MALICIOUS

PDF

44.6 KB Authoring application: PDFedit First seen: 2026-05-08
MD5: 30080cd27b3e3b2b87f906e1c96b67d2 SHA-1: 28bcc1f4a6b165500b62892532af0f73c3b47865 SHA-256: b21cf3b8edf50f0a0a86fa14fc44f7708653d4f9eda7ae1c46fc03d3ad52f452
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs suggest a phishing or malicious content distribution scheme, likely aiming to redirect users to further malicious PDFs. The document body contained garbled text, providing no additional context for the attack's pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nanascountryporch.com/uploads/1/3/0/6/130621124/setovuvuvejezesig.pdf In PDF document text
    • http://7-niebo.com/uploads/1/3/0/6/130620228/wubinawaxisekaj.pdfIn PDF document text
    • http://www.fixyourclassic.co.uk/uploads/1/3/0/2/130271063/850ead21a0f6.pdfIn PDF document text
    • http://shineupandrise.com/uploads/1/3/0/6/130604056/4309105.pdfIn PDF document text
    • http://rmheffects.com/uploads/1/3/0/4/130476318/detapamif.pdfIn PDF document text
    • http://rickformi.net/uploads/1/3/0/5/130588635/1954077.pdfIn PDF document text
    • http://openpaw.net/uploads/1/3/0/2/130272071/ruwinesileg.pdfIn PDF document text
    • http://jolenesphotography.com/uploads/1/3/0/2/130287514/dcf405b.pdfIn PDF document text
    • http://ellestewart.com/uploads/1/3/0/6/130639407/rabakan.pdfIn PDF document text
    • http://docksideengraving.com/uploads/1/3/0/8/130813953/2cdb418bc.pdfIn PDF document text
    • http://atlkickball.com/uploads/1/3/0/2/130272282/9042351.pdfIn PDF document text
    • http://showcasehomepainting.com/uploads/1/3/0/2/130287915/bitora-nedalusazilefas-rodomomemowovem-nawidakijakaj.pdfIn PDF document text
    • http://hackatx.info/uploads/1/3/0/7/130775902/8865a4238a4c.pdfIn PDF document text
    • http://rockymountainhighimages.com/uploads/1/3/0/8/130814032/wimepatim-petowuse-rilagonemisuta.pdfIn PDF document text
    • http://thingraniteveneer.com/uploads/1/3/0/6/130620778/502749.pdfIn PDF document text
    • http://peireptileexpo.ca/uploads/1/3/0/6/130621700/df5e0f98b989b7a.pdfIn PDF document text
    • http://t24player.live/uploads/1/3/0/5/130588763/209cdc1.pdfIn PDF document text
    • http://salaamboston.com/uploads/1/3/0/5/130540290/6631733.pdfIn PDF document text
    • http://norshus.com/uploads/1/3/0/5/130588286/4348080.pdfIn PDF document text
    • http://tateglass.com/uploads/1/3/0/2/130291352/figidafezibinon.pdfIn PDF document text
    • http://ctmelectricinc.com/uploads/1/3/0/8/130814675/lowufukilavuvop.pdfIn PDF document text
    • http://mercedes.fit/uploads/1/3/0/6/130621483/lepojudodezimux_matifujuna_rixiboka_nujalinabetiri.pdfIn PDF document text
    • http://omc4thgrade.com/uploads/1/3/0/6/130621798/zoxituvobisumew.pdfIn PDF document text
    • http://taleinthetail.com/uploads/1/3/0/8/130814232/130814232.html#html+table+with+rowspan+and+colspan+exampleIn PDF document text
    • http://ptc.company.com/uploads/1/3/0/3/130379363/farugimizega_memifuvuxanozim_wetujujazasume_mikogekiborax.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33AC 8928 bytes
SHA-256: f592bba58cad1c13646b17c345e5fdaf76a301b5a950b88a8b0c784fdf8afbd2
font_01_sfnt_off00005197.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5197 16076 bytes
SHA-256: 0c8b636322dcb4d69dd08a763b09c4b5ff2b7ea73056f43add13012560a79e6e

Open this report in the interactive analyzer, or submit your own file for analysis.