Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9cb99f044e80cf6…

MALICIOUS

PDF

54.0 KB Authoring application: Poppler-utils First seen: 2026-05-09
MD5: cdfd46ad205c327a146245ceda3c47f8 SHA-1: 08ae1aea9e98bcb3538b91d25a5146e5eef5d9c8 SHA-256: d9cb99f044e80cf60dcd7885bdc0466b9c4b1d6cc942fbf5aa177cb52e9b73bc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external PDF links. The ML classifier also strongly indicated maliciousness. The embedded URLs suggest a phishing or SEO spam campaign, aiming to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://holycowchocolate.com/uploads/1/3/0/3/130313368/rireloritupadafozobo.pdf In PDF document text
    • http://davisionfilms.com/uploads/1/3/0/6/130621488/1da7826b174.pdfIn PDF document text
    • http://pinkysgotpurses.com/uploads/1/3/0/7/130739567/desafa_seniliruginuwow.pdfIn PDF document text
    • http://nomnomgelato.com.au/uploads/1/3/0/5/130546880/61720bcb75db.pdfIn PDF document text
    • http://milescan.com/uploads/1/3/0/6/130604543/6b76946b28.pdfIn PDF document text
    • http://billelenbark.net/uploads/1/3/0/6/130621057/dutape.pdfIn PDF document text
    • http://cynicalpicnic.com/uploads/1/3/0/3/130324137/2118105.pdfIn PDF document text
    • http://waea.net/uploads/1/3/0/3/130379146/40dde320b04d.pdfIn PDF document text
    • http://mrsrashid.com/uploads/1/3/0/5/130539757/sepenututowuxavabifa.pdfIn PDF document text
    • http://phillywaxing.com/uploads/1/3/0/5/130590374/gironajozimebunuz.pdfIn PDF document text
    • http://detailpoint.nl/uploads/1/3/0/2/130272937/mamuxipixozezababo.pdfIn PDF document text
    • http://moir.se/uploads/1/3/0/6/130604486/eecd5a27653.pdfIn PDF document text
    • http://acouturelife.com/uploads/1/3/0/4/130479210/130479210.html#bleacher+report+week+8+fantasy+football+rankingsIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000134b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134B 8796 bytes
SHA-256: 4c663c9d7819e8a66689773ffa2346e305cafe8e20bba42e0fcd7de0155926b4
font_01_sfnt_off00008283.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8283 16356 bytes
SHA-256: ef16810021e0f51ad518176571e1abf7ee1dfdb2484f5d40e6061b602b871e5a
font_02_sfnt_off000097f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x97F4 2048 bytes
SHA-256: 8ec8c2252d1b0a1cc16637c0e1f77da7137146423e231c53be47bbaf832064ce

Open this report in the interactive analyzer, or submit your own file for analysis.