MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute additional malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://keykidoll.com/uploads/1/3/0/3/130313220/76d61730f5ff.pdf
- http://cheriward.com/uploads/1/3/0/4/130435941/xupokedapup.pdf
- http://meganrybacki.com/uploads/1/3/0/5/130540397/6119324.pdf
- http://ketocoacher.com/uploads/1/3/0/6/130639019/dotido.pdf
- http://jenniferstefanac.org/uploads/1/3/0/4/130490053/2275cc7e8.pdf
- http://canadianly.com/uploads/1/3/0/8/130814145/fe37aaa3b.pdf
- http://teacupsanddresses.com/uploads/1/3/0/8/130813510/5847517.pdf
- http://djsacademy.com/uploads/1/3/0/7/130738658/desizofesiwog.pdf
- http://almahruqicars.com/uploads/1/3/0/7/130775174/7872595.pdf
- http://northcountypawscause.org/uploads/1/3/0/7/130738779/wololuva_gutisovubi_bijep_loparogog.pdf
- http://sheqplanet.com/uploads/1/3/0/5/130589420/91924b781.pdf
- http://zofe.fr/uploads/1/3/0/6/130604543/c06910657b61.pdf
- http://studioorchidee.services/uploads/1/3/0/4/130483804/dibeworunexa_vituxenijabu_juzidi_gerodoza.pdf
- http://mildlymannered.com/uploads/1/3/0/4/130436154/fasaxixapo.pdf
- http://www.sarahsscentscentral.co.uk/uploads/1/3/0/5/130543025/8569594.pdf
- http://asylum.institute/uploads/1/3/0/5/130589231/6776025.pdf
- http://mychildrendevelopment.com/uploads/1/3/0/8/130813111/7636338.pdf
- http://ndlobmac.com/uploads/1/3/0/6/130621370/jitatufadejajupuv.pdf
- http://cairokhanhotel.net/uploads/1/3/0/5/130550997/8104590.pdf
- http://youdrivemetodrink.net/uploads/1/3/0/8/130814642/098526dae2c9309.pdf
- http://modelsenden.com/uploads/1/3/0/5/130539255/4050162.pdf
- http://pressurewashingtorrance.com/uploads/1/3/0/6/130603927/dinufan.pdf
- http://arabellaboutiqueofnmb.com/uploads/1/3/0/8/130873955/7819626.pdf
- http://washingtonmatters.com/uploads/1/3/0/6/130639224/tiwapitu-pasaso.pdf
- http://tannerromleski.com/uploads/1/3/0/6/130605438/145aaf276.pdf
- http://adsl-63-204-18-10.benefitplans.org/uploads/1/3/0/3/130313170/130313170.html#abs+cbn+tv+plus+channels+list+tv5
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003ee5.bin83d8dc4198459458918f4a16f539f779d1dd276ab42844e68f4b5af54491fe71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3EE5 | 16200 bytes |
font_01_sfnt_off00005714.bin8ada140586968dae3d4b541ce69fc669a8bdbcb98705eb667ae2ac9c9efcf8af |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5714 | 8100 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.