MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for phishing or malware. ClamAV identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', further supporting a phishing or malicious intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.budapestacousticband.hu/uploads/1/3/0/7/130739895/riwamuzosedize.pdf
- http://mx.ea-abc.org/uploads/1/3/0/3/130324278/rezak.pdf
- http://bigboyrobo.com/uploads/1/3/0/2/130289515/1d0d94d.pdf
- http://premierbeachfl.com/uploads/1/3/0/3/130323461/nowevebofukepufebu.pdf
- http://motionfuels-arkansas.com/uploads/1/3/0/5/130551651/lijapanodegipid-vewezetur.pdf
- http://mail.dustysprinklers.com/uploads/1/3/0/8/130874136/3677546.pdf
- http://christophmeyer-weller.com/uploads/1/3/0/9/130969366/f8ebcaff.pdf
- http://mountainandwaterstudio.com/uploads/1/3/0/8/130813369/3347950.pdf
- http://hostmaster.immaginepca.it/uploads/1/3/0/6/130639438/0222a5c6a2.pdf
- http://goldheart.us/uploads/1/3/0/6/130640172/gipilemuv.pdf
- http://silvabuildings.com/uploads/1/3/0/6/130604147/menikunavovip.pdf
- http://themossgroupllc.org/uploads/1/3/0/5/130546977/xuguwovesuvoru.pdf
- http://iccaroo.org/uploads/1/3/0/4/130476322/6039561.pdf
- http://www.jsallnaturals.com/uploads/1/3/0/5/130588980/wofofedamumuxum.pdf
- http://seaviewpainting.com.au/uploads/1/3/0/4/130490665/2884866.pdf
- http://luckofthedraw.fun/uploads/1/3/0/5/130589420/6877127.pdf
- http://mx69.farmfreshsoaps.com/uploads/1/3/0/6/130605240/suwirifebomilupokiwu.pdf
- http://looe-festival-of-the-sea.com/uploads/1/3/0/6/130639661/5642532.pdf
- http://natashafine.com/uploads/1/3/0/4/130436390/rozutugogo.pdf
- http://obediencejourney.com/uploads/1/3/0/5/130550838/xotolonokilupu.pdf
- http://markkraemer.net/uploads/1/3/0/7/130776405/zokodekodoguzun-nimagum-gexokut-weven.pdf
- http://afforablehomesociety.com/uploads/1/3/0/6/130639400/zimelavur.pdf
- http://andresbeatstore.com/uploads/1/3/0/2/130287881/35bb89a8.pdf
- http://www.mikeisthekey.com/uploads/1/3/0/9/130969725/130969725.html#logic+gates+explained+with+boolean+algebra
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00005ebb.bin085d66cbde92bc2546a708dd5f060297de955063814a1c7bdc14ba48889de09c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5EBB | 3712 bytes |
font_01_sfnt_off00006b2c.bin4cad911d68e2816258fee8e3921ab3f90b60e145840eb4cd12b6829e7a654d5b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B2C | 16560 bytes |
font_02_sfnt_off00008535.bina402768d93f1c16b7186b80cad678bb6030dd93fe7304b9dd3d3a78931858c1f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8535 | 9740 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.