Malicious PDF — malware analysis report

Static analysis result for SHA-256 bede6a2c520693fc…

MALICIOUS

PDF

42.3 KB Authoring application: Serif PagePlus First seen: 2026-06-04
MD5: 42fc064533b4e687ffc43e5e529b62d6 SHA-1: 5ba2be55d873641aadad94aec31ff4af2d21a7cc SHA-256: bede6a2c520693fcec8c3879ec0f73430b916dadbb532a1d5f702651ac6fb10c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF file contains a large number of embedded URLs pointing to external PDF files hosted on Weebly. This pattern is indicative of SEO spam or a phishing campaign designed to redirect users to malicious content. The ClamAV detection and ML classifier further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bapuvujupa.weebly.com/uploads/1/3/0/4/130435721/9487853.pdf In PDF document text
    • https://tijafusefekaj.weebly.com/uploads/1/3/0/3/130313188/xesiguzigaj.pdfIn PDF document text
    • https://kowipololu.weebly.com/uploads/1/3/0/3/130313070/fa67855de7d.pdfIn PDF document text
    • https://nonulazu.weebly.com/uploads/1/3/0/4/130488780/18b7f95.pdfIn PDF document text
    • https://tifumepege.weebly.com/uploads/1/3/0/2/130289734/xusiwulanaxapu-fokivaxonixaz-rewar.pdfIn PDF document text
    • https://jojazuvisanipe.weebly.com/uploads/1/3/0/5/130544872/88d7344f76.pdfIn PDF document text
    • https://busufovemawut.weebly.com/uploads/1/3/0/4/130483184/cf03870ad195445.pdfIn PDF document text
    • https://duravuxeku.weebly.com/uploads/1/3/0/2/130289679/cbd061e40bad8.pdfIn PDF document text
    • https://jotojiposakab.weebly.com/uploads/1/3/0/4/130476034/1520126.pdfIn PDF document text
    • https://nexubezetigim.weebly.com/uploads/1/3/0/5/130539128/gisonorag_fuzotukepokas_jinugeribusiwi.pdfIn PDF document text
    • https://tojaroti.weebly.com/uploads/1/3/0/4/130475939/jewusajifapo.pdfIn PDF document text
    • https://jibopelaruga.weebly.com/uploads/1/3/0/4/130436071/makoseti.pdfIn PDF document text
    • https://sokedovuz.weebly.com/uploads/1/3/0/3/130323293/27f14.pdfIn PDF document text
    • https://bawobuzodalib.weebly.com/uploads/1/3/0/3/130379219/e6a9c422ca.pdfIn PDF document text
    • https://movamategi.weebly.com/uploads/1/3/0/4/130490193/8111584.pdfIn PDF document text
    • https://mimuwarelige.weebly.com/uploads/1/3/0/3/130323928/e5b737417f0.pdfIn PDF document text
    • https://vijerezemug.weebly.com/uploads/1/3/0/4/130476242/3192b0.pdfIn PDF document text
    • https://nowogumu.weebly.com/uploads/1/3/0/4/130483350/nuwabono.pdfIn PDF document text
    • https://newiwozebumid.weebly.com/uploads/1/3/0/3/130323585/buvanowagebijof.pdfIn PDF document text
    • https://rejogolep.weebly.com/uploads/1/3/0/2/130271259/zolofug_ralimugejotose_wuturud.pdfIn PDF document text
    • https://teserawixuxukor.weebly.com/uploads/1/3/0/4/130483338/486827.pdfIn PDF document text
    • https://xozojubezuzira.weebly.com/uploads/1/3/0/5/130543462/ninumesofu.pdfIn PDF document text
    • https://nuvesefasupev.weebly.com/uploads/1/3/0/4/130488891/kapuxeseniw_jewinimajitivil_pelezafonanusa.pdfIn PDF document text
    • https://rajazuguruvowof.weebly.com/uploads/1/3/0/4/130435722/1393378.pdfIn PDF document text
    • https://ranatosukuxad.weebly.com/uploads/1/3/0/4/130483748/7211204.pdfIn PDF document text
    • https://ladorigil.weebly.com/uploads/1/3/0/4/130476332/130476332.html#difference+between+first+and+third+angle+projection+symbolsIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001751.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1751 7836 bytes
SHA-256: 5ff87f2c048a797b0214fd9276efe43115bc8cad6c45ab2d01e3cf7349bcb8c2
font_01_sfnt_off0000692c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x692C 2616 bytes
SHA-256: d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04

Open this report in the interactive analyzer, or submit your own file for analysis.