MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links to external PDF files hosted across numerous domains. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://introducingfriends.net/uploads/1/3/0/7/130739713/795ff0.pdf
- http://prenupcounsel.net/uploads/1/3/0/5/130590698/1d7e7a57e.pdf
- http://annaravenscroft.com/uploads/1/3/0/3/130313145/manojikaxobet.pdf
- http://3mfarmandranch.com/uploads/1/3/0/6/130621596/werofigow-jizuxo.pdf
- http://nerdysecretsinside.online/uploads/1/3/0/2/130289550/5934761.pdf
- http://www.we2cangrow.com/uploads/1/3/0/5/130551745/mosoted.pdf
- http://michellerosa.org/uploads/1/3/0/6/130620519/fabosixos-jiwot-sexosajav.pdf
- http://mspledgersclass.com/uploads/1/3/0/6/130604336/8032961.pdf
- http://chrysalisholistics.com/uploads/1/3/0/7/130739326/2971571.pdf
- http://www.parknorthdesigns.com/uploads/1/3/0/3/130323423/wubajikoxenilopameja.pdf
- http://kpmhs.com/uploads/1/3/0/5/130590613/4396950.pdf
- http://theaccountantthatlovestech.com/uploads/1/3/0/7/130775734/kavolevila-bijop-rozemumojisilon.pdf
- http://franckinvest.com/uploads/1/3/0/6/130621932/fc0fc24.pdf
- http://skeletonsoutofthecloset.com/uploads/1/3/0/5/130547884/wefutovozelelavebivu.pdf
- http://myketoquest.com/uploads/1/3/0/4/130489418/6a740b413a.pdf
- http://northeastgridironpromotions.com/uploads/1/3/0/6/130621959/f3cb7e116c0abdb.pdf
- http://unikornandco.com/uploads/1/3/0/7/130775527/fabuziwefa.pdf
- http://nataliekfitness.com/uploads/1/3/0/6/130605166/kupitag-xitefuz.pdf
- http://sublimeart.co.nz/uploads/1/3/0/5/130588393/vosomizokasi.pdf
- http://www.departmentofdoughnuts.com/uploads/1/3/0/8/130874458/8967846.pdf
- http://mommieceoapparel.com/uploads/1/3/0/7/130775652/pumozabemimer.pdf
- http://create-a-tree.com/uploads/1/3/0/5/130539798/1135185.pdf
- http://www.rachelfleischmann.com/uploads/1/3/0/2/130270823/mufuj-babibi.pdf
- http://niakohimura.com/uploads/1/3/0/7/130775198/27361b62499cc1.pdf
- http://wellosophy.com/uploads/1/3/0/4/130483187/3297587.pdf
- http://79.bpmtc.com/uploads/1/3/0/8/130814591/130814591.html#uretritis+por+clamidia+diagnostico
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004537.binec19bfd940b2fcfdec683db9b5653c87b173124bda2e7f39d0ae1eb7bcacec89 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4537 | 3112 bytes |
font_01_sfnt_off00004f6d.bin6d339afc6a78fbfcca0319c110a55134b4027f7ef506b24a2eb2e0a831d1c235 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4F6D | 16192 bytes |
font_02_sfnt_off0000679b.bin9833d1abd2980c311f73c2210bf0ee77f3b2185497f5e0302093cfff2eeab231 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x679B | 8932 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.