MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute additional malicious content. While no scripts were extracted, the sheer volume of outbound links points to a coordinated effort to redirect users, likely as part of a phishing or SEO spam campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ageinmyplace.net/uploads/1/3/0/6/130604321/6640136.pdf
- http://gimme.site/uploads/1/3/0/2/130272387/4197709.pdf
- http://northeasternohiomasonry.com/uploads/1/3/0/2/130288498/winax_kafiloz.pdf
- http://squltural.com/uploads/1/3/0/6/130604014/a4d1d2f11.pdf
- http://develleoper.com/uploads/1/3/0/7/130739663/xuven_gisebali_zibuw_xatefuxakon.pdf
- http://cldipatent.com/uploads/1/3/0/2/130291552/7e803.pdf
- http://aquariumempire.com/uploads/1/3/0/5/130551174/5287534.pdf
- http://blakebuilds.us/uploads/1/3/0/3/130324340/tulag-zusapi-kunutezoru-bajonodanomavag.pdf
- http://madeiradrywall.com/uploads/1/3/0/8/130813829/1283414.pdf
- http://demenagementsos.com/uploads/1/3/0/4/130478709/52eadfed41d818.pdf
- http://musicforsoho.com/uploads/1/3/0/2/130291707/7665983.pdf
- http://investedin.net/uploads/1/3/0/6/130604341/zowigevaxudiz-tikavizux-gajod.pdf
- http://pornabl.com/uploads/1/3/0/2/130288317/mugup.pdf
- http://webdisk.nickiedwardsauthor.com/uploads/1/3/0/3/130313002/7171850.pdf
- http://myprintpad.com/uploads/1/3/0/5/130588762/6045596.pdf
- http://quickcontacts.com.au/uploads/1/3/0/5/130590036/gejinum-sojagizalit-wutoma-pixivevivefuxu.pdf
- http://parcelshipping.international/uploads/1/3/0/6/130621327/nanazuzalefu.pdf
- http://blushingbrideboutiqueltd.com/uploads/1/3/0/5/130547373/298b6113.pdf
- http://professionalmalevoiceoverservice.com/uploads/1/3/0/2/130272327/14a892e.pdf
- http://richmontoya.com/uploads/1/3/0/5/130589045/1d9cf3430859.pdf
- http://suportland.net/uploads/1/3/0/6/130620521/riranakosenafet-jugokejegurulod-jodumabu.pdf
- http://thekookas.com/uploads/1/3/0/5/130588806/c28d76171c.pdf
- http://cameliascandles.org/uploads/1/3/0/4/130483924/9333557.pdf
- http://drakepaintingllc.com/uploads/1/3/0/7/130740598/352324.pdf
- http://huangjiayulezhinan.br3h.com/uploads/1/3/0/9/130969335/130969335.html#airway+assessment+anaesthesia+slideshare
- http://fontawesome.iohttp://fontawesome.io/license/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000051fc.bin19c5fce83e456a796e1368f43604ece917409e81de26a4c20f588591bb9f6cc0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51FC | 1620 bytes |
font_01_sfnt_off00005ceb.bin0eb8f50713f11503c29e601e72496c00412f43aca271330187ecf360af076ffa |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5CEB | 8800 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.