MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded links to other PDF files hosted on various external domains, indicating a link farm or redirection mechanism. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution. The document body contains garbled text and a few URLs, but the primary malicious indicator is the extensive link farm.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://nalacc.com/uploads/1/3/0/7/130775033/faxidilipibunapu.pdf In PDF document text
- http://modernparentingnetwork.com/uploads/1/3/0/6/130603744/792566.pdfIn PDF document text
- http://bodysoulhealing.net/uploads/1/3/0/7/130739500/3187071.pdfIn PDF document text
- http://artworkrunner.com/uploads/1/3/0/6/130603995/wugafon-zufonolono-nomatavi-nosebele.pdfIn PDF document text
- http://movies-music-and-games.com/uploads/1/3/0/7/130739924/pumerudif.pdfIn PDF document text
- http://kchcapital.com/uploads/1/3/0/4/130489038/d8588296.pdfIn PDF document text
- http://secretgourmetpicnic.com/uploads/1/3/0/5/130550858/jovifunogag.pdfIn PDF document text
- http://nawebworks.co.uk/uploads/1/3/0/7/130739301/e343f9.pdfIn PDF document text
- http://drumvoice.org/uploads/1/3/0/4/130489706/18955.pdfIn PDF document text
- http://bluecornconsultingllc.com/uploads/1/3/0/7/130775291/5378576.pdfIn PDF document text
- http://messinger-systems.com/uploads/1/3/0/5/130540266/pimuveg.pdfIn PDF document text
- http://mtidaarkansas.com/uploads/1/3/0/4/130492689/peson.pdfIn PDF document text
- http://garysresume.com/uploads/1/3/0/4/130483770/kujej_xamulu_fitig_kenavija.pdfIn PDF document text
- http://michaudsblog.com/uploads/1/3/0/6/130620631/vopufiwiv.pdfIn PDF document text
- http://fynnad.store/uploads/1/3/0/6/130605001/xekerimomogivi_girabigapepeg_renimigiruduwom.pdfIn PDF document text
- http://elyaqui69.com/uploads/1/3/0/5/130543261/kiwuzegotuf.pdfIn PDF document text
- http://rootedinmma.com/uploads/1/3/0/4/130476074/860175.pdfIn PDF document text
- http://jackpassion.net/uploads/1/3/0/3/130313180/bomesufedipekami.pdfIn PDF document text
- http://host115.carmichaelnl.com/uploads/1/3/0/7/130776695/130776695.html#febrile+seizure+paediatricIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003842.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3842 | 7480 bytes |
SHA-256: 4339e187996f1bbe2240f4c67765920179b6b4f1a79113b17d328920235b4eac |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.