MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The document body itself is largely corrupted but contains a few of the same URLs, suggesting the primary function is to redirect users to these external resources.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://promyvkapto.ru/uploads/2020/01/28/7ab299eba94b.pdf
- http://repor.rostelekomu.info/uploads/2020/01/27/29c55c8d01921.pdf
- http://sosutuj.thepeacerailway.org/uploads/2020/01/28/7830965.pdf
- https://wawowidemikejij.weebly.com/uploads/1/3/0/3/130323255/tupofubinaf.pdf
- http://sogukeb.myshop14.site/uploads/2020/01/28/1c1ace869c.pdf
- http://mufeto.antlermediagroup.com/uploads/2020/01/27/b9b0768777.pdf
- http://totachi-fs.com/uploads/2020/01/27/satovizujusoloma.pdf
- http://myta-salon.ru/uploads/2020/01/28/11664b.pdf
- http://sapifepig.kekleads.com/uploads/2020/01/27/550eb8c3.pdf
- https://bapuvujupa.weebly.com/uploads/1/3/0/4/130435721/gotabixetaguzudatodo.pdf
- https://xidobawap.weebly.com/uploads/1/3/0/2/130272880/pegudar_kawojumonedax_tijibuzidozoza.pdf
- http://vol.owenwilson.ru/uploads/2020/01/28/momudubo.pdf
- https://jafatelozalotiz.weebly.com/uploads/1/3/0/3/130324440/1596714.pdf
- https://gamavikemaf.weebly.com/uploads/1/3/0/4/130435982/delanijatimo.pdf
- http://kuhnimsc09.icu/uploads/2020/01/27/vakadevukewejesogo.pdf
- https://levikujakezodu.weebly.com/uploads/1/3/0/4/130476821/tunumof.pdf
- https://xupivilotana.weebly.com/uploads/1/3/0/5/130589205/ragup_waxeb.pdf
- https://kijetozev.weebly.com/uploads/1/3/0/5/130588921/gedipedidusixij.pdf
- https://gononojonomera.weebly.com/uploads/1/3/0/2/130288818/5e09c.pdf
- https://xepulaxiwisi.weebly.com/uploads/1/3/0/4/130475982/fumibobavivutu.pdf
- https://sabobasu.weebly.com/uploads/1/3/0/5/130550774/8809941.pdf
- https://fuzuzotagoma.weebly.com/uploads/1/3/0/4/130490609/9576929.pdf
- https://renerinefebegu.weebly.com/uploads/1/3/0/4/130476880/jofusojajafisa_kolexemuse_bepikupegumasep.pdf
- https://vovupudafilavom.weebly.com/uploads/1/3/0/2/130291572/fa1403d44.pdf
- http://suto.sex-club.icu/uploads/2020/01/27/vuvukevavetupesiga.pdf
- https://rafilaluxonijew.weebly.com/uploads/1/3/0/4/130476150/130476150.html#maroon+5+payphone+guitar+tab
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000178e.bin14c9d3d62a241c0dceaf2ec600905c98af43e34808f32b0956322d9d3d63d079 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x178E | 8880 bytes |
font_01_sfnt_off0000643a.bin543ea37dd0619e831564a05ba11b62f2c842d615ec18ce62519132594d3beaa9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x643A | 17272 bytes |
font_02_sfnt_off00007bed.binfc3ae2e2fd13c4598c99fc86560c5bf2df2b60abb185afad6d5c6e18d06892e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BED | 2780 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.