MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large farm of external links, many of which point to other PDF files hosted on various domains. The document body text mentions 'Jawahar navodaya vidyalaya class 6 entrance result 2019', suggesting a lure to trick users into clicking these links. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://jdlockhartphotography.com/uploads/1/3/0/4/130436125/a64e6dd5.pdf In PDF document text
- http://vertes.com.sg/uploads/1/3/0/3/130323697/xejokole.pdfIn PDF document text
- http://reginavalle.com/uploads/1/3/0/7/130776298/1421363.pdfIn PDF document text
- http://ablossominglifeec.org/uploads/1/3/0/2/130291910/topotetiviru_pexubitakew.pdfIn PDF document text
- http://awakeningthedivinewithin.com/uploads/1/3/0/6/130620224/4846976.pdfIn PDF document text
- http://bluthirty2.com/uploads/1/3/0/2/130291416/supizalo-bijelonananidid-lunafitef.pdfIn PDF document text
- http://partocica.com/uploads/1/3/0/3/130379295/f38825.pdfIn PDF document text
- http://hiltyhazzard.com/uploads/1/3/0/8/130814728/9404695.pdfIn PDF document text
- http://aaliyakhan.com/uploads/1/3/0/3/130323599/fanizepa.pdfIn PDF document text
- http://mail.jrba.org/uploads/1/3/0/8/130874422/lufazaguriterenor.pdfIn PDF document text
- http://wurzeltube.com/uploads/1/3/0/8/130813855/7165494.pdfIn PDF document text
- http://ohioccwtraining.net/uploads/1/3/0/6/130639360/2174092.pdfIn PDF document text
- http://www.miyukitomura.com/uploads/1/3/0/5/130590538/3879604.pdfIn PDF document text
- http://rollinghillsmobileterrace.com/uploads/1/3/0/6/130640021/nojotonadasivu-fisigifu-moline.pdfIn PDF document text
- http://mrelectricalservices.com.au/uploads/1/3/0/6/130639153/siwejuvara.pdfIn PDF document text
- http://ivybradley.com/uploads/1/3/0/6/130639698/suduwofolaso-piwatev-gojobi.pdfIn PDF document text
- http://p9jzm.slpny.com/uploads/1/3/0/6/130620594/130620594.html#jawahar+navodaya+vidyalaya+class+6+entrance+result+2019In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000032bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x32BB | 13100 bytes |
SHA-256: 6c4d2f66e1c9f21c5d150b07e73aa6dd1840336332455f42235ae77699735e59 |
|||
font_01_sfnt_off0000580a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x580A | 7648 bytes |
SHA-256: b4453f68be50fd206a534f975bf27a7eb6ba11af28c09db9e40a0e5d37e40d25 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.