Malicious PDF — malware analysis report

Static analysis result for SHA-256 deb75bbabce6d758…

MALICIOUS

PDF

50.0 KB Authoring application: pstoedit First seen: 2026-05-09
MD5: cdcc61765aa04ced50230cb7c37e6314 SHA-1: 165652986ab054f6afd3bc8c969dc80af4c0bdf8 SHA-256: deb75bbabce6d758679edc2cf8b73c342284b3c1ad2cef290ff78dde87366407
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to PDF files on various domains, indicating a link farm for SEO or phishing purposes. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's content is designed to trick users into paying fees for a prize or parcel. ClamAV also identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs are likely used to direct users to malicious content or further phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brainrinsing.com/uploads/1/3/0/6/130621024/resaris.pdf In PDF document text
    • http://autodiscover.paulsturfandtree.com/uploads/1/3/0/6/130604358/sajatapixipimovow.pdfIn PDF document text
    • http://mta-sts.mx.crchog.org/uploads/1/3/0/5/130539249/wulug.pdfIn PDF document text
    • http://communitycure.net/uploads/1/3/0/6/130639540/mijowowewir_bavifiw_vogurag.pdfIn PDF document text
    • http://swankyfork.com/uploads/1/3/0/5/130539516/8114919.pdfIn PDF document text
    • http://erinandevan.com/uploads/1/3/0/6/130621200/b0d0624e.pdfIn PDF document text
    • http://guru-inside.com/uploads/1/3/0/4/130488228/gerejuputepetubafuz.pdfIn PDF document text
    • http://kevindeuso.com/uploads/1/3/0/5/130546486/1335771.pdfIn PDF document text
    • http://immigrantsday.org/uploads/1/3/0/8/130814020/349ab.pdfIn PDF document text
    • http://dcbiggs.com/uploads/1/3/0/2/130271184/143ce836.pdfIn PDF document text
    • http://www.chemicalbathsaltsonline.com/uploads/1/3/0/5/130541743/davosevufe.pdfIn PDF document text
    • http://micheletroy.com/uploads/1/3/0/6/130603704/sararin.pdfIn PDF document text
    • http://domesticsquirrel.com/uploads/1/3/0/7/130738623/putufu.pdfIn PDF document text
    • http://benchmark-your-store.com/uploads/1/3/0/2/130289254/jowasagaketusam-wesibo.pdfIn PDF document text
    • http://precisiondecorative.com/uploads/1/3/0/5/130588754/cc6243b.pdfIn PDF document text
    • http://www.torsodecor.com/uploads/1/3/0/4/130488288/loxanifagaki.pdfIn PDF document text
    • http://fightingthefight.org/uploads/1/3/0/7/130776110/8244a61e4e.pdfIn PDF document text
    • http://kristenshirts.com/uploads/1/3/0/6/130639138/7edf89efa97be.pdfIn PDF document text
    • http://yenisiyasetkulturu.com/uploads/1/3/0/2/130288402/a0ca0ea8bea.pdfIn PDF document text
    • http://www.yaayaavintage.com/uploads/1/3/1/0/131070072/7308282.pdfIn PDF document text
    • http://crystaldictionary.online/uploads/1/3/0/5/130589004/92047a56.pdfIn PDF document text
    • http://ecopowerelectric.net/uploads/1/3/0/7/130740116/130740116.html#airtel+digital+tv+recharge+monthly+plansIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AE4 16164 bytes
SHA-256: 32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56
font_01_sfnt_off000062c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62C3 8248 bytes
SHA-256: 6cf8236914f0941e88b218207c3b7e85b0b144635fa96c6accfc1bb4d336d13e

Open this report in the interactive analyzer, or submit your own file for analysis.