MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://plantcityhomesforsale.net/uploads/1/3/0/7/130739897/6771162.pdf In PDF document text
- http://kitchensdoorsanddrawers.com/uploads/1/3/0/5/130541023/3254270.pdfIn PDF document text
- http://insidedentalequipment.com/uploads/1/3/0/8/130874264/tuwadizoso_tilumapo_bawomujez_vepunub.pdfIn PDF document text
- http://dimensionalfinancialservices.com/uploads/1/3/0/3/130379379/kikivupi-gifunim-witixurafimaf.pdfIn PDF document text
- http://session9photography.com/uploads/1/3/0/7/130776077/1798263.pdfIn PDF document text
- http://www.vapes4veterans.com/uploads/1/3/0/5/130588931/vegilel.pdfIn PDF document text
- http://naughtybottom.net/uploads/1/3/0/2/130274098/e2f56fd4f6557.pdfIn PDF document text
- http://missionalentrepreneur.com/uploads/1/3/0/5/130550833/dulem.pdfIn PDF document text
- http://thetrixxband.com/uploads/1/3/0/5/130540085/4743002.pdfIn PDF document text
- http://vacavillelimos.com/uploads/1/3/0/5/130543106/3016680.pdfIn PDF document text
- http://seattleyouthbaseball.com/uploads/1/3/0/4/130492127/8875cd9c703343e.pdfIn PDF document text
- http://pdxart.net/uploads/1/3/0/8/130813577/janunesulasok.pdfIn PDF document text
- http://jnrconstruction.net/uploads/1/3/0/7/130739048/daludeba.pdfIn PDF document text
- http://jeaninewhiteunlockinggreatness.com/uploads/1/3/0/2/130291561/mumirebir-menadafa-dejadodajeveta-devim.pdfIn PDF document text
- http://astaplescarpenterforhireinc.com/uploads/1/3/0/4/130476035/wimalumilowugawi.pdfIn PDF document text
- http://axispoint.co/uploads/1/3/0/4/130490053/1268189.pdfIn PDF document text
- http://rampantgames.net/uploads/1/3/0/6/130640107/zelagegoluraxaj_napevovuditu.pdfIn PDF document text
- http://nzbriards.com/uploads/1/3/0/2/130288757/masujofamuxuk.pdfIn PDF document text
- http://kid-o-quotes.com/uploads/1/3/0/6/130621552/6237398.pdfIn PDF document text
- http://919.bpmtc.com/uploads/1/3/0/4/130483804/130483804.html#email+sending+resume+and+cover+letter+sampleIn PDF document text
🗂 Part of campaign:
astaplescarpenterforhireinc.com
7 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003bad.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3BAD | 8308 bytes |
SHA-256: 9286eae67fd127d575ad390aad5d0917c503b1e31c4e567c18a571fb0fedb479 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.