MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection further support its malicious nature, classifying it as phishing-related malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mochiecouture.com/uploads/1/3/0/5/130546880/7736047.pdf
- http://terriguy.com/uploads/1/3/0/4/130476244/21248db.pdf
- http://anneweisstherapy.com/uploads/1/3/0/4/130477420/d098b34c7.pdf
- http://alaskafoodie.info/uploads/1/3/0/6/130639583/f2e1d2e7f.pdf
- http://florendostudioarts.com/uploads/1/3/0/7/130738603/2971140.pdf
- http://www.mohnayminks.com/uploads/1/3/0/2/130288006/nuvisabozifak-pefifev-zefunare-fojuzaniwedegun.pdf
- http://aliciashouse.net/uploads/1/3/0/4/130435842/df061e5e3c3.pdf
- http://leftback.co.uk/uploads/1/3/0/2/130288506/vediw.pdf
- http://mydenson.com/uploads/1/3/0/2/130270911/voxifenaborebipedufo.pdf
- http://levelupintuition.com/uploads/1/3/0/7/130738512/tisel.pdf
- http://calgarymobileiv.com/uploads/1/3/0/3/130323755/b419d10f.pdf
- http://emergworld.com/uploads/1/3/0/6/130639563/kitewijaroz-jedonumutejo-pususivagom.pdf
- http://monetki.website/uploads/1/3/0/3/130313243/fbd10.pdf
- http://nowhiringheroes.net/uploads/1/3/0/5/130590164/kabineguxamek_wajufaridodavaj.pdf
- http://se8ed.com/uploads/1/3/0/5/130588394/pesapisarutug.pdf
- http://plussizebridesmaiddressesmassachusetts.com/uploads/1/3/0/7/130738765/4157128.pdf
- http://servereserves.com/uploads/1/3/0/2/130270743/belobozubo.pdf
- http://nordicwarriortraining.com/uploads/1/3/0/5/130545932/9d8b97.pdf
- http://bootstrappingbetty.com/uploads/1/3/0/5/130543320/vivobakuwegoral_rogepepelusewa_ginasadu_bozoli.pdf
- http://cameliascandles.org/uploads/1/3/0/6/130603929/825dacf65c.pdf
- http://host121.carmichaelnl.com/uploads/1/3/0/6/130639839/130639839.html#acids+bases+and+salts+for+class+10+cbse+notes+pdf+download
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000045d3.bine2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45D3 | 2652 bytes |
font_01_sfnt_off00004eaf.bin196cba584dcff683a9a17900749c0f15e5052d8a4a72954217c1a4a90e817cfe |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EAF | 16088 bytes |
font_02_sfnt_off00006664.bin0cd8251b48c944d265d1eeb9d5ee6522f42f36f14ab0f0406e7d40e6ac06e651 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6664 | 8580 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.