MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The primary heuristic indicates a PDF SEO link farm, with 31 external PDF links generated. The document body contains garbled text but includes the URL http://tate.betterqualityreviews.com/uploads/2020/01/28/tipos-ruzelagesalajub-fevulapekonujom-pasixuboriza.pdf, which is also listed as the first URL in the link farm. This suggests the document's purpose is to redirect users to a network of malicious or SEO-abused PDF files.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://tate.betterqualityreviews.com/uploads/2020/01/28/tipos-ruzelagesalajub-fevulapekonujom-pasixuboriza.pdf
- https://vuxamevolal.weebly.com/uploads/1/3/0/4/130435635/fetepemilun.pdf
- https://fomivipapatoba.weebly.com/uploads/1/3/0/2/130289693/dejowakupabet_zopugorikagufot.pdf
- https://tinomoduju.weebly.com/uploads/1/3/0/3/130379069/tusapenodimuzudi.pdf
- http://plus-avia.ru/uploads/2020/01/27/8841677.pdf
- https://jedusuxi.weebly.com/uploads/1/3/0/5/130589145/cc7d2011f7.pdf
- http://bijiduwifu.fonariky.ru/uploads/2020/01/28/e27c7a8f0f4b5c3.pdf
- https://lezotafaxevume.weebly.com/uploads/1/3/0/2/130289205/7703903.pdf
- http://notuja.jetscan.tech/uploads/2020/01/28/9869105.pdf
- http://wabeva.tilr.icu/uploads/2020/01/27/290034.pdf
- http://tavufe.ecoopower.com/uploads/2020/01/28/7924889.pdf
- http://tegunos.wise-design.ru/uploads/2020/01/27/voleposa_dobipo_lukivona.pdf
- https://mepukifunepaki.weebly.com/uploads/1/3/0/5/130550912/sanuvudimozez.pdf
- https://sasawibow.weebly.com/uploads/1/3/0/6/130604945/botojuwo.pdf
- https://sizuxifuxez.weebly.com/uploads/1/3/0/3/130313359/a21e988fa.pdf
- https://foxapubab.weebly.com/uploads/1/3/0/2/130272363/5768812.pdf
- http://frata.ru/uploads/2020/01/28/xesavokafomij.pdf
- http://fido.onlinezaimbot.ru/uploads/2020/01/28/busix_lepezakefoleluf_bujewadigovoji_givag.pdf
- http://bavox.land-booking.com/uploads/2020/01/27/julazexerivujatipu.pdf
- https://jominobited.weebly.com/uploads/1/3/0/2/130289305/4247484.pdf
- http://lixazadoda.3ndfl-nalogi.ru/uploads/2020/01/27/porabaji.pdf
- https://gutamado.weebly.com/uploads/1/3/0/2/130271015/lavipevoxurikev.pdf
- https://modoliwudu.weebly.com/uploads/1/3/0/2/130272592/lirudi.pdf
- https://rafilaluxonijew.weebly.com/uploads/1/3/0/4/130476150/130476150.html#polar+to+rectangular+matlab+code
- http://fido.onlinezaimbot.ru/uploads/2020/01/28/busix_lepezakefoleluf_bujewadigovoji_givag
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001745.bin0ee1e7647bc5291c95118521e92fa16fedc294e9b381a26f1cca573b9f7f5f23 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1745 | 9276 bytes |
font_01_sfnt_off00007178.bin2cdbb021946863abefcea69c147ecba1deb91015bdcbfab198bfb9b45e854878 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7178 | 16540 bytes |
font_02_sfnt_off000087bb.bin11eff0542ee112a7a4f3d5fa86892f13f7f7c80edb17354215cea33bb7714487 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x87BB | 2768 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.