MALICIOUS
180
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing 31 external PDF links, and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The presence of a visual download button and a callback lure suggests a phishing or tech-support scam attempt. The numerous embedded URLs likely serve to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://nortegrandeenelmundo.com/uploads/1/3/0/5/130588425/f5e1acdb.pdf
- http://bnbgourou.net/uploads/1/3/0/4/130488331/sabumipefabitiv.pdf
- http://www.erikasvisions.com/uploads/1/3/0/6/130604025/7a97ad.pdf
- http://nonreligiousspiritual.com/uploads/1/3/0/7/130775370/safek.pdf
- http://lolman.net/uploads/1/3/0/5/130588377/xadulo-luvubanovor.pdf
- http://tatchens.com/uploads/1/3/0/3/130323764/7786795.pdf
- http://www.wncta.com/uploads/1/3/0/6/130620547/jimisuwemi.pdf
- http://pistoncleaner.com/uploads/1/3/0/7/130738874/vimoz_guvuvivaner_jirevakalobiw_pisesaw.pdf
- http://www.zodiacmusic.net/uploads/1/3/0/6/130639038/145c008d.pdf
- http://costamedicalmarijuana.com/uploads/1/3/0/2/130291453/2222182.pdf
- http://project-otaku.com/uploads/1/3/0/7/130740078/ad0de53ddcc02be.pdf
- http://mail.awha.org/uploads/1/3/0/6/130639547/6160536.pdf
- http://hostmaster.forstehjelpkompetanse.no/uploads/1/3/0/4/130475936/difomasagubik-tubukedubado.pdf
- http://bloomboxenergy.us/uploads/1/3/0/6/130604040/823610b7dc46f.pdf
- http://producebros.com/uploads/1/3/0/6/130639117/gasupuvijojogu.pdf
- http://hempstartshere.com/uploads/1/3/0/8/130874413/1470236.pdf
- http://solemateshoerepair.com/uploads/1/3/0/5/130540725/275312.pdf
- http://reneedumarr.com/uploads/1/3/0/5/130589121/2771509.pdf
- http://dryerbeats.com/uploads/1/3/0/2/130291779/fidaxunebujasam.pdf
- http://www.southernoregondhhed.com/uploads/1/3/0/6/130639962/130639962.html#aditya+birla+sun+life+mutual+fund+swp+form
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002e28.bin32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2E28 | 16164 bytes |
font_01_sfnt_off000045fc.bin8ee671573f9916e53eccb1b531d48433716b609a11ddba831469efa97b54d3a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45FC | 8384 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.