MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier strongly indicate malicious intent. The embedded URLs are likely used to redirect users to malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://jillelliott.photography/uploads/1/3/0/2/130270831/welelawexumiso.pdf
- http://joycrownedproducts.com/uploads/1/3/0/4/130435835/c2075e1bba2bde.pdf
- https://zawexosuzab.weebly.com/uploads/1/3/0/5/130588583/4975389.pdf
- http://fumebepuk.faithmirror.com/uploads/2020/01/28/nalofupoxitizozazod.pdf
- http://melikset.ru/uploads/2020/01/29/1024062.pdf
- http://xylitogum.net/uploads/1/3/0/5/130538950/adbacdcc53004.pdf
- http://nabeelreviews.com/uploads/1/3/0/2/130289729/4343158.pdf
- http://blast-man.com/uploads/1/3/0/5/130542692/gawipuzazam-dumonedowoxo-metosetepewu.pdf
- https://nodikaro.weebly.com/uploads/1/3/0/4/130488141/dusok-daxixa-voxenafinu-mozetumo.pdf
- http://jug.provape.ru/uploads/2020/01/28/4459905.pdf
- https://nibefumax.weebly.com/uploads/1/3/0/2/130273982/nenoboduxok.pdf
- http://powergeardrums.com/uploads/1/3/0/3/130379311/wefujigef-tujawekogu-daginowepamud.pdf
- http://thecomputershophv.com/uploads/1/3/0/4/130488476/aeb28ebd00e16c0.pdf
- http://kbrownmath.weebly.com/uploads/1/3/0/5/130590689/bedemej-rabemu-pumubufejaxuwu-duzov.pdf
- http://clinicaespacosaudebeleza.net/uploads/1/3/0/5/130551341/muvoze-venufigoso-lekaf.pdf
- http://soulscriticalpath.com/uploads/1/3/0/4/130489185/6962876.pdf
- http://nazcamp.org/uploads/1/3/0/5/130546354/ca9a2ab40d8727.pdf
- http://konrn.com/uploads/1/3/0/6/130620956/wejenibenagopimizar.pdf
- http://mi-12ventures.com/uploads/1/3/0/6/130639481/xotezefopexisazipo.pdf
- http://123-give.com/uploads/1/3/0/5/130545745/b57c35c761613.pdf
- http://mome.mailsens01.online/uploads/2020/01/27/1911858.pdf
- https://bowatato.weebly.com/uploads/1/3/0/5/130588639/ddd800c3d1b5.pdf
- http://seasonedservices.com/uploads/1/3/0/6/130604635/viwowofefop-dupomulalol-degopim-kawumuw.pdf
- http://dimattiadesigns.com/uploads/1/3/0/4/130476432/jizosuzoxom.pdf
- http://sacredzones.com/uploads/1/3/0/2/130287547/jedaxonexutapij-netudedel-zixiruziwelogo-dapen.pdf
- http://nobuhotelriyadh-fullsite.devsite-1.com/uploads/1/3/0/6/130620627/130620627.html#sairat+movie++in+tamilrockers
- http://nazcamp.org/uploads/1/3/0/5/130
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000017fe.bin1e536c22fea83919a1b0f55d3ce1b05f2c80fc83bd073adb07a188fce6974542 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17FE | 8132 bytes |
font_01_sfnt_off000073e1.bin32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x73E1 | 16164 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.