MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the heuristic 'PDF_SEO_LINK_FARM' strongly indicate a phishing or malware distribution attempt. The document body, though heavily corrupted, contains references to antivirus software, likely a lure to encourage downloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://thecolororacle.com/uploads/1/3/0/5/130588749/8392328.pdf In PDF document text
- http://wob4000.com/uploads/2020/01/28/fovudega_mazukapar.pdfIn PDF document text
- http://sweetpeasdreamzzz.com/uploads/1/3/0/3/130313070/5981410.pdfIn PDF document text
- http://whatyouwantcreations.com/uploads/1/3/0/5/130551279/6819989.pdfIn PDF document text
- http://decojewelry.net/uploads/1/3/0/5/130539697/696adc680239230.pdfIn PDF document text
- http://newdirectionintlmin.com/uploads/1/3/0/4/130483477/b2fa2f5d8e7d3.pdfIn PDF document text
- http://loguzepedi.conceptfashionfest.ru/uploads/2020/01/29/nivose.pdfIn PDF document text
- https://vonidumog.weebly.com/uploads/1/3/0/5/130551219/758710.pdfIn PDF document text
- https://wagesozowu.weebly.com/uploads/1/3/0/4/130483872/fegov.pdfIn PDF document text
- http://rujoj.cargo-floor.ru/uploads/2020/01/28/katuvagudejit_raxivari_zitinob_fotaviz.pdfIn PDF document text
- http://runwildandbe.com/uploads/1/3/0/6/130621153/sovowalomuzif_podufakukib.pdfIn PDF document text
- http://odessawaterwell.com/uploads/1/3/0/5/130550929/xoralizunideda.pdfIn PDF document text
- http://humannaturefoundation.com/uploads/1/3/0/5/130541924/932deb2d77.pdfIn PDF document text
- http://aahardwood.com/uploads/1/3/0/2/130289363/7927224.pdfIn PDF document text
- http://missfass.com/uploads/1/3/0/5/130588343/polidoxelenanis_toselebidu.pdfIn PDF document text
- http://michaelazoe.com/uploads/1/3/0/6/130621127/lisiweju_pusuxivade_votepapewanudo_kutulafepi.pdfIn PDF document text
- http://mightymustangband.com/uploads/1/3/0/3/130323709/846090.pdfIn PDF document text
- http://suekodress.com/uploads/1/3/0/6/130605165/xixal.pdfIn PDF document text
- http://stjohnvianneymorisset.com/uploads/1/3/0/3/130324340/gomij.pdfIn PDF document text
- http://cyclebavaria.com/uploads/1/3/0/5/130588445/130588445.html#antivirus+avast+64+bitIn PDF document text
🗂 Part of campaign:
keyproserv.com
3 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000015c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15C2 | 8728 bytes |
SHA-256: 0a0970a006719297815f9ff5a04a1d8d56e67974d7a68914ff854b92fafe2cd6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.