MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded URLs pointing to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://madisonscouts.net/uploads/1/3/0/6/130640031/demelur-tiripose.pdf In PDF document text
- http://baanekspres1995.com/uploads/1/3/0/4/130436258/bb30c6.pdfIn PDF document text
- http://troop115.com/uploads/1/3/0/5/130551387/pefovemilelibu.pdfIn PDF document text
- http://psychotherapyportland.net/uploads/1/3/0/3/130323601/7616717.pdfIn PDF document text
- http://br.rqa.com/uploads/1/3/0/4/130476216/1a6a68711c.pdfIn PDF document text
- http://modernbyken.com/uploads/1/3/0/7/130775033/jitafitida-zafulademofi-nafezufumozi-busanojox.pdfIn PDF document text
- http://finishlineacademy.com/uploads/1/3/0/8/130814172/3399791.pdfIn PDF document text
- http://blogapna.com/uploads/1/3/0/2/130271067/0354aa68.pdfIn PDF document text
- http://usedphotographyequipment.co.uk/uploads/1/3/0/5/130588363/sitoli_kalekasewizaja.pdfIn PDF document text
- http://thecellardistrict.com/uploads/1/3/0/4/130483474/2a955c.pdfIn PDF document text
- http://blackbusinessexpo1.com/uploads/1/3/0/4/130491008/2a352d.pdfIn PDF document text
- http://mypuriumsambi.com/uploads/1/3/0/6/130639750/e301012b.pdfIn PDF document text
- http://cpanel.readingpowerinc.org/uploads/1/3/0/7/130776517/ca9d9a8bd4f.pdfIn PDF document text
- http://goss-p.com/uploads/1/3/0/2/130289455/mebupaloj_riguge_buxonupowafolu.pdfIn PDF document text
- http://www.shatterproofwomen.com/uploads/1/3/0/7/130740013/wafadukeroda_jigikut.pdfIn PDF document text
- http://smokin.tires/uploads/1/3/0/6/130639966/130639966.html#hemoglobin+has+quaternary+structure+true+falseIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000017c8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17C8 | 10664 bytes |
SHA-256: 57ed0122b431372982b2c12f0a0a15851ed179754154809aff8aa26ac4e9de3d |
|||
font_01_sfnt_off0000e6c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6C2 | 17036 bytes |
SHA-256: ce07eb9461262d379961ad4920af677ca084d471c7b3b6870ad4f61acce85119 |
|||
font_02_sfnt_off0000ff17.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF17 | 4440 bytes |
SHA-256: 9502fe3ffb58d1f9c0d3e9da8595af994e8ac7c05a1a1207bbd199826b97c4bb |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.