MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1566.002 Spearphishing Link
The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This technique, identified as PDF_SEO_LINK_FARM, is commonly used to create link farms for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier further support its malicious nature, indicating it is likely a phishing or malware distribution lure.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://potusnewschannel.com/uploads/1/3/0/7/130740158/puritope.pdf In PDF document text
- http://mexpertnyc.com/uploads/1/3/0/4/130490338/dewuwazapur.pdfIn PDF document text
- http://clearstickerpaper.com/uploads/1/3/0/5/130590596/teniburutev_sizezigij_nupuroxazowi_kidaxupedu.pdfIn PDF document text
- http://meat-taffy.net/uploads/1/3/0/7/130776693/8362337.pdfIn PDF document text
- http://stuffthatsneat.com/uploads/1/3/0/5/130539336/f13b8e2e20e1.pdfIn PDF document text
- http://lakesfoodandcraft.com/uploads/1/3/0/2/130272482/todexunapuxobukawa.pdfIn PDF document text
- http://northstarpropertiesct.com/uploads/1/3/0/6/130621437/finoxixi_dasiborerotupeb_fetozunuk.pdfIn PDF document text
- http://mydrwalker.com/uploads/1/3/0/6/130621720/4861904.pdfIn PDF document text
- http://beltwayig.com/uploads/1/3/0/5/130588517/fugananesega-fuwenub-wagonem.pdfIn PDF document text
- http://platicus.net/uploads/1/3/0/5/130588786/5200364.pdfIn PDF document text
- http://everythinghighschool.com/uploads/1/3/0/5/130588867/733a9b2802d.pdfIn PDF document text
- http://sonoranshadows.com/uploads/1/3/0/2/130291433/5166606.pdfIn PDF document text
- http://heatherzidle.com/uploads/1/3/0/7/130775151/gewunewurogofum-fuvoze-wivaselezote-fulos.pdfIn PDF document text
- http://designsbycarolann.com/uploads/1/3/0/6/130620379/xoxutejuw.pdfIn PDF document text
- http://teamborkowski.com/uploads/1/3/0/6/130620354/somugu.pdfIn PDF document text
- http://www.dailyactsofkindness.org/uploads/1/3/0/7/130775506/maxobo.pdfIn PDF document text
- http://couplingmanufacturers.com/uploads/1/3/0/5/130588858/wubufosasozof_meruju_lenuka_pebifuwudomu.pdfIn PDF document text
- http://knowledgelord.com/uploads/1/3/0/7/130739375/ronorosewawesari.pdfIn PDF document text
- http://betterburner.com/uploads/1/3/0/6/130639296/rivasimereki.pdfIn PDF document text
- http://nickdeanconsulting.com/uploads/1/3/0/5/130551245/937448932428aaf.pdfIn PDF document text
- http://s5xpv.bpmtc.com/uploads/1/3/0/5/130540604/130540604.html#spherical+aberration+in+spectacle+lensesIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00000fe8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE8 | 7692 bytes |
SHA-256: 5dcb33c16ed947e0acef3db602e0ed862599d896487bde5c74a394a503427e33 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.