MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1566.002 Spearphishing Link
The PDF file exhibits characteristics of a link farm, embedding a large number of external URLs. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection intent. The embedded URLs are likely used to distribute further malicious content or to engage in SEO-based phishing campaigns.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bandstreamtv.com/uploads/1/3/0/3/130379429/zamatugew.pdf
- http://absystemsllcscam.com/uploads/1/3/0/6/130621506/xunivezozax-runewejivuti-faget-vavosozur.pdf
- http://cancercoloring.com/uploads/1/3/0/3/130313037/de502dfec00.pdf
- http://playtyme.pro/uploads/1/3/0/3/130313480/3913104.pdf
- http://stan.holyrood-drama.com/uploads/1/3/0/4/130435791/ca02e7edf19.pdf
- https://rabutuxujizowo.weebly.com/uploads/1/3/0/5/130590738/ponevugajixorex.pdf
- http://wat.copyrightcontact-100000641253254.com/uploads/2020/01/28/wikilesigafajakog.pdf
- http://evq.ro/uploads/1/3/0/4/130475883/lozujedamum_koregusesodeg.pdf
- http://djskygarden.com/uploads/1/3/0/6/130604649/9546363.pdf
- http://pozer.masternode-sc.com/uploads/2020/01/28/vakiwosuwosimav.pdf
- http://famul.cityglush13.icu/uploads/2020/01/28/4edb9.pdf
- http://tezan.nayada-online.com/uploads/2020/01/28/fowepinaz.pdf
- http://dronkadiscountstore.com/uploads/1/3/0/6/130621721/nomewuv.pdf
- http://heavenlypoodlesanddodles.com/uploads/1/3/0/4/130483286/9362290.pdf
- http://riverhaircompany.com/uploads/1/3/0/6/130639036/7937346.pdf
- http://staceyphillips.online/uploads/1/3/0/6/130604767/gavunuxijinoni-kudezod-supuveneg.pdf
- http://villagearch.com/uploads/1/3/0/6/130639895/710bd9643.pdf
- http://relovusav.bitforlife.ru/uploads/2020/01/29/0c57e37871.pdf
- http://jotovelipi.knb-games.pw/uploads/2020/01/29/nigawurifageguxul.pdf
- http://cornwall2theandes.com/uploads/1/3/0/6/130621701/5700192.pdf
- https://guzipesezigepof.weebly.com/uploads/1/3/0/5/130588230/pegozelawib.pdf
- http://mykeenhr.com/uploads/1/3/0/6/130605206/jipirok.pdf
- http://nutritionunique2u.com/uploads/1/3/0/6/130639861/5f2fe0a0a0ed.pdf
- http://djspizza1.com/uploads/1/3/0/6/130622075/130622075.html#annotation+meaning+in+bioinformatics
- http://cornwall2theandes.com/uploa
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001145.bin0a80ab5120cacb4234b99a61a2b19c65604264fffc50378af74b1ca212f6c69d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1145 | 9536 bytes |
font_01_sfnt_off0000a492.bina21efb935ba7927aa0c330d71eafac0bec157a07a9dbf1ba89d155084433c02a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA492 | 3008 bytes |
font_02_sfnt_off000137c8.binc80e6931ddf043c2081b726c95be8760efa837b197be091eb23593ba07788d07 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x137C8 | 16400 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.