Malicious PDF — malware analysis report

Static analysis result for SHA-256 becff86c36137b7a…

MALICIOUS

PDF

42.7 KB Authoring application: OpenOffice.org First seen: 2026-05-08
MD5: 5cde5d02eae9d19ac3650a5a3e714f0f SHA-1: ec10c151aca8d4a960a35f003bc56296a5edf339 SHA-256: becff86c36137b7a993dc00321a3d733b5c91b0345357eeb85af278c3bc01875
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The document body's content appears to be corrupted or truncated, providing no direct clues to the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://topdoc.net.au/uploads/1/3/0/7/130739758/buzivima.pdf In PDF document text
    • http://miwoori.net/uploads/1/3/0/5/130540725/323797.pdfIn PDF document text
    • http://urenough.com.au/uploads/1/3/0/5/130588333/xomafuvalatigonanod.pdfIn PDF document text
    • http://silver-linings-speechtherapy.com/uploads/1/3/0/6/130605164/pudunakatixuteg_lekozawivesad.pdfIn PDF document text
    • http://idcotter.com/uploads/1/3/0/4/130476378/ec708ef2a473.pdfIn PDF document text
    • http://christyrobbcareerandlifestyle.com/uploads/1/3/0/8/130873779/bixeselozuxosiz-judawinot.pdfIn PDF document text
    • http://americanlighting.org/uploads/1/3/0/6/130620796/ad3b571b.pdfIn PDF document text
    • http://draasman.com/uploads/1/3/0/5/130538866/pasokebekumo.pdfIn PDF document text
    • http://www.upallnite.org/uploads/1/3/0/8/130873894/2319221.pdfIn PDF document text
    • http://need4relief.com/uploads/1/3/0/7/130740262/4285907.pdfIn PDF document text
    • http://teamrise.global/uploads/1/3/0/2/130271017/paxozanibozovuz-sifegax-fibuku-xifevebapoze.pdfIn PDF document text
    • http://jmnofixedaddress.com/uploads/1/3/0/2/130288629/zoxakopadajo.pdfIn PDF document text
    • http://speed-gemmes.com/uploads/1/3/0/7/130776730/momebum.pdfIn PDF document text
    • http://rickyzheng.net/uploads/1/3/0/2/130292073/beresopezefanumo.pdfIn PDF document text
    • http://traveleatexplore.com/uploads/1/3/0/2/130271072/6671007.pdfIn PDF document text
    • http://www.bfandg.net/uploads/1/3/0/4/130489523/baxakojo.pdfIn PDF document text
    • http://dacusconsultingco.com/uploads/1/3/0/8/130873828/mofetezexepoj.pdfIn PDF document text
    • http://eatonhousewhiskey.com/uploads/1/3/0/6/130639774/vewanidu.pdfIn PDF document text
    • http://coffmannursing.com/uploads/1/3/0/6/130621191/xawalef-duzapojunera.pdfIn PDF document text
    • http://marijuanacultivationconsultants.com/uploads/1/3/0/5/130588230/zediturejo-fazebu-pokofanawunes-difera.pdfIn PDF document text
    • http://thededicatedgenealogist.com/uploads/1/3/0/8/130813539/mororaxalewopunamaf.pdfIn PDF document text
    • http://gmsdezigns.org/uploads/1/3/0/6/130622083/wijuwurez-jipigawujuzesa.pdfIn PDF document text
    • http://jacquipriestleyartist.com/uploads/1/3/0/6/130620176/vixun-rebokoxo-berem-mazapup.pdfIn PDF document text
    • http://houseof7brothers.com/uploads/1/3/0/9/130969820/7416390.pdfIn PDF document text
    • http://bet365zhongwen.br3h.com/uploads/1/3/0/5/130542727/130542727.html#clerks+private+sector+modern+award+2010In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41FD 8528 bytes
SHA-256: ee742cb584884cdda15cda5b5214a31968b552ed053d4fa1a8c7317c07776faa

Open this report in the interactive analyzer, or submit your own file for analysis.