MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this as malicious. The primary attack pattern appears to be directing users to a multitude of external PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://amazonchristmastree.com/uploads/1/3/0/7/130776541/tumeka.pdf
- http://soundengineercanada.com/uploads/1/3/0/4/130488295/0cca55e.pdf
- http://hostmaster.thegranarypenzance.co.uk/uploads/1/3/0/6/130639848/2780645.pdf
- http://mta-sts.mail.rikking.com/uploads/1/3/0/2/130272909/6299952.pdf
- http://jackyoung.co.za/uploads/1/3/0/6/130621215/3718879.pdf
- http://charlesdickensjewelry.com/uploads/1/3/0/5/130590295/mazonibuwinulibep.pdf
- http://www.esmacats.com/uploads/1/3/0/6/130621814/ae0d5e8ee4e32fc.pdf
- http://mta-sts.mail.criteriummarketing.com/uploads/1/3/0/4/130483667/2747102.pdf
- http://gaskinsgadgets.com/uploads/1/3/0/6/130639655/6965482.pdf
- http://teamthumann.com/uploads/1/3/0/8/130813658/6166304.pdf
- http://abrushwithnature.studio/uploads/1/3/0/6/130605161/9701833.pdf
- http://www.heavensgatescherryfarm.net/uploads/1/3/0/6/130604599/1443057.pdf
- http://www.topographyandink.com/uploads/1/3/0/9/130969552/fobufudif.pdf
- http://familygrowthcenter.com/uploads/1/3/1/0/131071220/cb1d770e6004.pdf
- http://ozimek.net/uploads/1/3/0/6/130622089/vetaxu-tuvigunawimibox-vizobizududov-biwufixonu.pdf
- http://adsl-63-204-18-36.benefitplans.org/uploads/1/3/0/5/130539440/9741795.pdf
- http://thepadremotel.com/uploads/1/3/0/6/130621422/8426774.pdf
- http://christopherreyesstudio.com/uploads/1/3/0/5/130589050/dbdb027073c.pdf
- http://teacherspetscalvert.com/uploads/1/3/0/5/130589308/2938838.pdf
- http://louisaanderic.com/uploads/1/3/0/2/130289171/kesojifo-mosenuker-janefen-zazawuvu.pdf
- http://bamboohealthsocks.com/uploads/1/3/0/8/130814666/rikomeref.pdf
- http://adventoursabroad.com/uploads/1/3/0/5/130544446/nidam.pdf
- http://www.greencircleweb.com/uploads/1/3/0/5/130550937/130550937.html#big+data+analysis+notes+pdf
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000033ec.binda097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x33EC | 16224 bytes |
font_01_sfnt_off000048c3.bin236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x48C3 | 2228 bytes |
font_02_sfnt_off000052ef.bin05558a388539c6acfb78530beea160568e0df548ebcb0cc6ed0db7441a58522a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x52EF | 8104 bytes |
font_03_sfnt_off00006a9d.bin5d53c2945c9faea56aff6b47e8794ee44415989b465db6e8e0034b5d1d60b4f7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A9D | 8360 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.