MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. Static analysis revealed a large number of embedded external links, indicating a potential link farm or redirection to malicious content. The document body contains obfuscated text and multiple URLs, reinforcing the phishing or malicious redirection intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://vosodoxof.kidlikes-cinema.ru/uploads/2020/01/28/gudebibusovat-zopobaf.pdf In PDF document text
- http://bitixiliz.member-neteller.mobi/uploads/2020/01/29/severonoponaz.pdfIn PDF document text
- http://joseelosegui.com/uploads/1/3/0/3/130313673/nevonafotej.pdfIn PDF document text
- https://selakujaxajovot.weebly.com/uploads/1/3/0/5/130540897/xotamekina.pdfIn PDF document text
- http://rtbartist.com/uploads/1/3/0/6/130620416/5853214.pdfIn PDF document text
- http://mskreslo.ru/uploads/2020/01/27/xavominigivaku-kikafo-jibobef-wodonujiw.pdfIn PDF document text
- https://subidajuguxax.weebly.com/uploads/1/3/0/5/130589180/2917306.pdfIn PDF document text
- http://noahsarkma.org/uploads/1/3/0/5/130552084/cbe6252e490.pdfIn PDF document text
- http://gasopika.mily.icu/uploads/2020/01/29/pabalazejama.pdfIn PDF document text
- http://steelcityselectsoftball.com/uploads/1/3/0/5/130547613/a37ba1ec645eef.pdfIn PDF document text
- http://thewarriorsoftruth.com/uploads/1/3/0/6/130639236/be6a96f136cd.pdfIn PDF document text
- http://cosmetictattoostudio.com/uploads/1/3/0/4/130490378/vejaruwejifa.pdfIn PDF document text
- https://falutexon.weebly.com/uploads/1/3/0/6/130603688/3198858.pdfIn PDF document text
- http://mvhsphotography.com/uploads/1/3/0/5/130550792/wajadufufibexis.pdfIn PDF document text
- http://sos-1.com/uploads/1/3/0/5/130550868/tofolaraw.pdfIn PDF document text
- http://mindforyou.org/uploads/1/3/0/6/130605072/130605072.html#bathukamma+songs+lyrics+in+telugu+pdfIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign:
mskreslo.ru
3 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000140e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x140E | 7600 bytes |
SHA-256: 7b456c9e8b08c20c29131c661e0e5672196533200fcdbced3f815ef1eefebe6d |
|||
font_01_sfnt_off000066a6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x66A6 | 7856 bytes |
SHA-256: bad41045811b0159ec1dbf9a0cfffca81eefcfdd8377f5bd33dfcf650f673e12 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.