Malicious PDF — malware analysis report

Static analysis result for SHA-256 edcfb15937142fb4…

MALICIOUS

PDF

38.6 KB Authoring application: Soda PDF First seen: 2026-05-08
MD5: 3b1bd1cf222e02fde6a984ecfc5f2d34 SHA-1: 1e1b0487170fc5cf69488ab6d7a669f6968789b3 SHA-256: edcfb15937142fb4f75d34c93035b0ba8598656f706cc59ccf349e2292976206
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to PDF files hosted on various domains, suggesting a link farm or redirection scheme. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cowgirlcloset.co/uploads/1/3/0/2/130270921/malexi.pdf In PDF document text
    • http://www.myfish.tw/uploads/1/3/0/7/130775972/d41c532ed8ae.pdfIn PDF document text
    • http://eefkeduin.nl/uploads/1/3/0/7/130775934/kemasagimuli_jetamizuxor_panufezotor.pdfIn PDF document text
    • http://mta-sts.mail.cpliofindiana.org/uploads/1/3/0/5/130551941/mavusof.pdfIn PDF document text
    • http://fundaciondrguillermocutuli.com/uploads/1/3/0/6/130621082/7839687.pdfIn PDF document text
    • http://westernhomesecurity.com/uploads/1/3/0/4/130490421/9a6600555.pdfIn PDF document text
    • http://eatthinkwin.com/uploads/1/3/0/4/130488839/024f27e1ead6.pdfIn PDF document text
    • http://queenkristene.com/uploads/1/3/0/4/130483489/wafutunawive.pdfIn PDF document text
    • http://xgens.org/uploads/1/3/0/5/130543976/jifetu-kesiwejozamuf-nubedefo-vuwivomeperomed.pdfIn PDF document text
    • http://nicolemfraley.com/uploads/1/3/0/8/130814112/dedimutune_goremefijes_vivopufigevugeb.pdfIn PDF document text
    • http://xtwdn6.brdge.org/uploads/1/3/0/3/130323596/mejor.pdfIn PDF document text
    • http://sobolagroup.com/uploads/1/3/0/3/130379352/b0f78b642f168e.pdfIn PDF document text
    • http://eveningshadows.org/uploads/1/3/0/4/130488220/fifijeranotu.pdfIn PDF document text
    • http://nalbarra.com.au/uploads/1/3/0/3/130323232/6960277.pdfIn PDF document text
    • http://bearvsbaby.net/uploads/1/3/0/7/130739235/64be1.pdfIn PDF document text
    • http://madisonandarveentietheknot.com/uploads/1/3/0/3/130323466/mimete-wasidiweze-sojiluxomujan-vevaluvoxe.pdfIn PDF document text
    • http://mrfriedliclass.com/uploads/1/3/0/6/130621158/purig.pdfIn PDF document text
    • http://eastermeditationretreat.org/uploads/1/3/0/7/130738847/aaefa5b5d.pdfIn PDF document text
    • http://mail.fitilis.gr/uploads/1/3/0/7/130775513/sujuzadaluxovenes.pdfIn PDF document text
    • http://mustoelaw.com/uploads/1/3/0/7/130775907/7867074.pdfIn PDF document text
    • http://816nc751.com/uploads/1/3/0/6/130621048/2a97905.pdfIn PDF document text
    • http://paraisoindustrial.com/uploads/1/3/0/4/130483625/8582116.pdfIn PDF document text
    • http://www.alnouraldaem.com/uploads/1/3/0/7/130740086/3571256.pdfIn PDF document text
    • http://professionalrenovationsofhamptonroads.com/uploads/1/3/0/2/130270990/3645505.pdfIn PDF document text
    • http://www.projectindigo.nl/uploads/1/3/0/2/130289282/jowiridufonaguf_fexaluw_zunup.pdfIn PDF document text
    • http://www.ivars-nettoyage.fr/uploads/1/3/0/2/130274097/130274097.html#ecg+sinus+bradycardia+otherwise+normalIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32CC 7756 bytes
SHA-256: be77b0e2efb0eca9734dcf319c041a4c3646597908d495e894af028326111231

Open this report in the interactive analyzer, or submit your own file for analysis.