MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO poisoning or phishing campaigns. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a distribution mechanism for further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mail.huddingedjurklinik.se/uploads/1/3/0/6/130639413/ac06935538f7.pdf In PDF document text
- http://cmillns.com/uploads/1/3/0/6/130639351/fd21e7b7.pdfIn PDF document text
- http://rotoruayachting.club/uploads/1/3/0/5/130588803/bominidadef-xozililisa-manadutejuwil-gezelimugexazuf.pdfIn PDF document text
- http://nomadel.com/uploads/1/3/0/7/130740086/8231251.pdfIn PDF document text
- http://aoodri.com/uploads/1/3/0/6/130603814/8066505.pdfIn PDF document text
- http://asianart.studio/uploads/1/3/0/5/130544091/4750948.pdfIn PDF document text
- http://sentientearth.net/uploads/1/3/0/6/130604844/66ade3d74530c.pdfIn PDF document text
- http://alldiseasebeginsinthegut.com/uploads/1/3/0/7/130740533/5962569.pdfIn PDF document text
- http://lisastory.space/uploads/1/3/0/7/130740598/a8bbe7d571.pdfIn PDF document text
- http://ocmunc.com/uploads/1/3/0/5/130542829/mizizubumi_piwuji_vujinun_bonamato.pdfIn PDF document text
- http://agavepress.com/uploads/1/3/0/7/130739887/takewidoru.pdfIn PDF document text
- http://luiscampuzanoconsultores.com/uploads/1/3/0/5/130588613/tawij.pdfIn PDF document text
- http://ryanhuff.net/uploads/1/3/0/2/130287852/raboxoba-nugibivuf-gezanolav-subonat.pdfIn PDF document text
- http://mountaingatewaytraining.org/uploads/1/3/0/8/130814387/75f5e.pdfIn PDF document text
- http://hostmaster.georgegoesout.co.uk/uploads/1/3/0/4/130483629/abbafb9409.pdfIn PDF document text
- http://provocateurla.com/uploads/1/3/0/6/130621657/10032a22d3e21.pdfIn PDF document text
- http://millennialjapan.com/uploads/1/3/0/6/130605159/givubabe_romojuxulex_tijirewax_farebijelowu.pdfIn PDF document text
- http://rejashorta.com/uploads/1/3/0/2/130289063/a30a33.pdfIn PDF document text
- http://moobite.com/uploads/1/3/0/5/130539155/993085.pdfIn PDF document text
- http://tcp-tcit.net/uploads/1/3/0/7/130775565/6329d80fb6220.pdfIn PDF document text
- http://host200.carmichaelnl.com/uploads/1/3/0/7/130775386/130775386.html#manufacturing+consent+noam+chomsky+and+the+media+pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003cc3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3CC3 | 8184 bytes |
SHA-256: 0c97959fe4e2c7a5cbf79761feea615703893d2c8ba82e2fe000086f31260f86 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.