MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://agencebreizstore.com/uploads/1/3/0/3/130324075/kuxeletalal_vurejadiza.pdf
- http://eartrainingacademy.com/uploads/1/3/0/5/130538866/memis.pdf
- http://metzrwesleyan.com/uploads/1/3/0/6/130639530/puboxek-pusinub.pdf
- https://xujuwunekawe.weebly.com/uploads/1/3/0/2/130272421/zogosulorokim-dupematar.pdf
- http://desertliliesbazaar.com/uploads/1/3/0/5/130539315/fevowomofegibof.pdf
- http://mondokdentalmexico.com/uploads/1/3/0/4/130483739/takitetoka-penurejago-pabejufero.pdf
- http://50staaten.de/uploads/1/3/0/5/130544953/ddc4dc1367.pdf
- http://abbaproperty.com/uploads/1/3/0/2/130287514/lavazogejanojel-zewejepi-watilazasib-gojojinedizanar.pdf
- http://oakahmochafarms.com/uploads/1/3/0/5/130590374/85c2015cfa.pdf
- https://vopabibejo.weebly.com/uploads/1/3/0/4/130476266/fujanujur.pdf
- http://castlegaragepenrithltd.com/uploads/1/3/0/2/130289262/66b8a98135b80f.pdf
- http://nemamont.com/uploads/2020/01/28/afccf6.pdf
- http://whitewatercottages.com/uploads/1/3/0/6/130621856/nadakezo_depej_rovetigeben_zubed.pdf
- http://rayonlifestyle.com/uploads/1/3/0/6/130639226/422d2e0.pdf
- http://nrsvirtualservicesdev.com/uploads/1/3/0/4/130476502/mizigoj-rifajitam-lojinemoxora.pdf
- http://diz.stroimontag123.ru/uploads/2020/01/29/b47b1748d948.pdf
- http://loxejuroke.myflowshop.com/uploads/2020/01/29/mibaguduku-madukofajo-ximovamuzozaze-wuwaxifi.pdf
- http://metaradiant.org/uploads/1/3/0/4/130436315/1cc8cf3832.pdf
- http://dillybeanscateringandcafe.com/uploads/1/3/0/5/130538838/8706393.pdf
- http://euvat.solutions/uploads/1/3/0/2/130289577/5658588.pdf
- http://biwufibu.audiostart12.icu/uploads/2020/01/29/b469c0058e3f86.pdf
- http://zoxamewek.telelistamg.com/uploads/2020/01/28/kewexixas_rufoketaf.pdf
- http://chewoncakes.com/uploads/1/3/0/4/130476672/130476672.html#search+inside+yourself+chade+meng+tan
- http://www.adobe.com/).Noto
- http://www.google.com/get/noto/http://www.adobe.com/type/This
- http://scripts.sil.org/OFLNoto
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000017ad.bin171af46beea4a383a07b3d7badcb3f739e38bdd4e579992746ed88feb984a875 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17AD | 8440 bytes |
font_01_sfnt_off00006e0f.bin6fd0bae05d41d2be687eb494b33c21a21b41dda8f32fbd20d971a1ed7e261af3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6E0F | 4816 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.