MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, likely related to phishing or spam distribution. The embedded URLs are the primary indicators of compromise, suggesting a campaign to drive traffic to these external resources.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://nyman.life/uploads/1/3/0/4/130483576/d6e5af10287.pdf
- http://etergrow.com/uploads/1/3/0/3/130323164/5654395.pdf
- http://bandstore.net/uploads/1/3/0/5/130550752/4485462.pdf
- http://www.ongediertebestrijding-kampen.com/uploads/1/3/0/3/130323415/sobemafer.pdf
- http://nortmilkendigital.com/uploads/1/3/0/6/130604259/ed35c9a28e2ccb7.pdf
- http://3gatewaycenter.com/uploads/1/3/0/3/130379297/fatukizoxej.pdf
- http://williamfrankel.com/uploads/1/3/0/5/130551177/783818.pdf
- http://www.iscremodeling.com/uploads/1/3/0/5/130590511/sadutij-fedexedomedid-fonipilazusonok-xuxekagotulolew.pdf
- http://webdisk.goodtimessinger.com/uploads/1/3/0/4/130476152/8a85b3f.pdf
- http://triajecareservices.co.uk/uploads/1/3/0/9/130969974/jerofolatax_tobola.pdf
- http://flowm.io/uploads/1/3/0/5/130541137/sogefumedawapef-mekatinasojej.pdf
- http://www.holistichealinggranada.com/uploads/1/3/0/2/130288532/7a904fde291bd.pdf
- http://prayassociates.gift/uploads/1/3/0/5/130546294/liben-fezot-tagud-kidavawijax.pdf
- http://energiasenal.com/uploads/1/3/0/5/130547418/731394.pdf
- http://torqdrft.com/uploads/1/3/0/4/130477252/5412314.pdf
- http://pelabarba.com/uploads/1/3/0/2/130271076/sogapibadegilip.pdf
- http://umbau.us/uploads/1/3/0/5/130540266/zuwizuvunoxidu.pdf
- http://www.alldogsaresmart.info/uploads/1/3/0/5/130539554/viwitugiwibuzij-wiwereziwe.pdf
- http://howlingdog.ca/uploads/1/3/0/3/130379222/49d766e39dc.pdf
- http://mkmyoga.com/uploads/1/3/0/7/130738909/8160252.pdf
- http://plaguepilgrim.com/uploads/1/3/0/8/130814855/rekopelopagugo.pdf
- http://maintco.org/uploads/1/3/0/4/130483848/1260b1805633.pdf
- http://dartistessalon.com/uploads/1/3/0/4/130476342/4961906.pdf
- http://gkbbbq6.brdge.org/uploads/1/3/0/2/130272886/130272886.html#ultrasound+guided+suprascapular+nerve+block+video
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000147a.bin511683255ee4c30f6e8ec6aac829c957e91c2b3f3c31395557ee9e5e96f79047 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x147A | 8700 bytes |
font_01_sfnt_off0000a98a.binbde475f8daf2763ac8b4cd59ecddfcae3f7de11c80a62175665df95184a9bd09 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA98A | 2912 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.