MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and ML classification strongly supports its malicious nature. The embedded URLs are the primary indicators of malicious activity, suggesting a campaign to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://prophecyoutlook.org/uploads/1/3/0/5/130551266/potipawe_fuwububag_pizeji.pdf In PDF document text
- http://tomisenamakeup.com/uploads/1/3/0/7/130739280/jubikivijeli.pdfIn PDF document text
- http://www.caroce.net/uploads/1/3/0/5/130590122/1bc513c6554050.pdfIn PDF document text
- http://eileenplichta.com/uploads/1/3/0/6/130620574/nepubajurime_wibotidu_lutoj_zudexiwotazam.pdfIn PDF document text
- http://bloompainters.com/uploads/1/3/0/2/130289532/buwejalesibagowewe.pdfIn PDF document text
- http://www.jcfishstand.com/uploads/1/3/0/6/130639997/xutodo_zajuweze_tanadakub.pdfIn PDF document text
- http://lifetrackfinancialadvisors.com/uploads/1/3/0/6/130604856/waganetijilik-fonobezi.pdfIn PDF document text
- http://motorshare.org/uploads/1/3/0/7/130738762/aef8a0f335e26.pdfIn PDF document text
- http://xvalhalla.com/uploads/1/3/0/8/130814754/gifabufojuned.pdfIn PDF document text
- http://mobilegroomersarasota.com/uploads/1/3/0/4/130483811/d264fa981230877.pdfIn PDF document text
- http://jesusisoursheperdministry.com/uploads/1/3/0/7/130740609/16f2dc.pdfIn PDF document text
- http://blackmakeupartistla.com/uploads/1/3/0/6/130639962/a10c55e4.pdfIn PDF document text
- http://myawaribox.com/uploads/1/3/0/4/130483770/sabumababa.pdfIn PDF document text
- http://hazeperformance.com/uploads/1/3/0/5/130551745/29c7eb.pdfIn PDF document text
- http://paradise-kdg.org/uploads/1/3/0/6/130604687/numuf.pdfIn PDF document text
- http://village-life.com/uploads/1/3/0/6/130603978/sobatefipir.pdfIn PDF document text
- http://heritagebrush.com/uploads/1/3/0/6/130620451/xavasivavemolu.pdfIn PDF document text
- http://shoesbynatalia.com/uploads/1/3/0/7/130740066/fusoxuzux_radugaxolokisos.pdfIn PDF document text
- http://sblimexprnce.com/uploads/1/3/0/6/130620818/xupedom.pdfIn PDF document text
- http://livelocalcard.com/uploads/1/3/0/5/130551132/wewuzuze_zabomotal_xekixuduwewute_vemusotigotada.pdfIn PDF document text
- http://alohabrewed.com/uploads/1/3/0/2/130272493/witupakojufesebeze.pdfIn PDF document text
- http://flowalong.com/uploads/1/3/0/5/130540477/f409dc3.pdfIn PDF document text
- http://amh2sl.salon225.com/uploads/1/3/0/6/130621950/130621950.html#pathophysiology+of+hepatitis+b+virusIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004694.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4694 | 7596 bytes |
SHA-256: 15b73ce7719080651434c3ef3ac233159b798f50eaa58362f390c0ec0046d8c1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.