MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, a technique commonly used in SEO poisoning and phishing campaigns to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs suggest a link farm designed to distribute further malicious content or phish for information.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://drsba.org/uploads/1/3/0/6/130621574/kodujonivolin.pdf In PDF document text
- http://thinkupdate.com/uploads/1/3/0/4/130436154/ribigetalepiwe.pdfIn PDF document text
- http://sousmarine.de/uploads/1/3/0/3/130323251/divexebamelomo_lugek.pdfIn PDF document text
- http://carretillasbarcelona.net/uploads/1/3/0/5/130545816/2243284.pdfIn PDF document text
- http://tasteparty.jpjsweets.com/uploads/1/3/0/8/130814666/663ec47cbfe.pdfIn PDF document text
- http://readthinkwritespeak.com/uploads/1/3/0/7/130738997/1026105.pdfIn PDF document text
- http://saint-malo-agence-immobiliere-cabinetmoraine.com/uploads/1/3/0/6/130620321/tuxefuvutabeku_fuvifukofovapaz.pdfIn PDF document text
- http://prolinelifepharmaceutical.com/uploads/1/3/0/6/130621031/5400172.pdfIn PDF document text
- http://www.ship-of-theseus.org/uploads/1/3/0/8/130814401/6228662.pdfIn PDF document text
- http://kaukauproductions.com/uploads/1/3/0/4/130476273/a5b65763b1.pdfIn PDF document text
- http://fuckingprogress.com/uploads/1/3/0/7/130775573/1045554.pdfIn PDF document text
- http://myssample.com/uploads/1/3/0/5/130539428/7226815.pdfIn PDF document text
- http://penguinpants.com/uploads/1/3/0/6/130603847/cd7fc976.pdfIn PDF document text
- http://mydhfastmandat.com/uploads/1/3/0/2/130272600/ruwalajiva.pdfIn PDF document text
- http://ladyboner.net/uploads/1/3/0/5/130550949/baf43f.pdfIn PDF document text
- http://host95.carmichaelnl.com/uploads/1/3/0/6/130603917/130603917.html#old+seven+wonders+of+the+world+in+hindiIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign:
ladyboner.net
3 samples
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000a76e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA76E | 1388 bytes |
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0 |
|||
font_01_sfnt_off0000b27f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB27F | 20820 bytes |
SHA-256: d110cf698686b74c69cedcb09a40aa3da45639cd3aee7219be56d52a16ae86b0 |
|||
font_02_sfnt_off0000e9bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9BB | 7468 bytes |
SHA-256: 34ef282a7b5b5b6ced3dfd2cb4ce8d53bb6ce42d38e27695f2f2ffde27fb568a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.