MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or a phishing distribution mechanism. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The document body contains fragmented text and URLs, reinforcing the link farm hypothesis.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mmsestatelettings.com/uploads/1/3/0/3/130379206/6c82d17.pdf In PDF document text
- http://genedi.transcom78.ru/uploads/2020/01/27/7483538.pdfIn PDF document text
- http://wivuw.stillika.ru/uploads/2020/01/27/d17c8398204b6d6.pdfIn PDF document text
- http://journeylutheranministries.com/uploads/1/3/0/4/130435500/2901463.pdfIn PDF document text
- https://ruzajufumetitat.weebly.com/uploads/1/3/0/3/130313495/3464928.pdfIn PDF document text
- http://degosidu.netto-tc.ru/uploads/2020/01/27/0d00065c3.pdfIn PDF document text
- http://wit.evroplast92.ru/uploads/2020/01/28/pefizeborakup_levutiwotulapip_meguvidesumu_padudogunowi.pdfIn PDF document text
- http://kupitonline.info/uploads/2020/01/28/3239835.pdfIn PDF document text
- https://sipurabi.weebly.com/uploads/1/3/0/5/130588651/7054f64c.pdfIn PDF document text
- http://kozopedugi.financebinom.info/uploads/2020/01/28/4894669.pdfIn PDF document text
- http://zazo.dda-russia.com/uploads/2020/01/29/gapusawe.pdfIn PDF document text
- http://mulekum.rkmw.ru/uploads/2020/01/28/a647add1.pdfIn PDF document text
- http://smithpointpartyrentals.com/uploads/1/3/0/6/130621570/xirugumaf.pdfIn PDF document text
- http://piwu.colorsun.ru/uploads/2020/01/28/kakuvumopotebemusimu.pdfIn PDF document text
- http://mukuluz.decodereadlearn.com/uploads/2020/01/28/dasumeniluxin.pdfIn PDF document text
- https://wafunelitidiko.weebly.com/uploads/1/3/0/5/130541133/5734205.pdfIn PDF document text
- https://xowuvibuwu.weebly.com/uploads/1/3/0/5/130550741/wepovam-nusebojozan.pdfIn PDF document text
- http://vipajagovo.coachesportivo.com/uploads/2020/01/27/kosipuzawejet.pdfIn PDF document text
- http://tofusefo.sietmexico.com/uploads/2020/01/28/vapinazo-kezufafe.pdfIn PDF document text
- http://juwexutik.expertmagnit.ru/uploads/2020/01/28/be6e839e10aa50c.pdfIn PDF document text
- http://bridgebuildingsupply.com/uploads/1/3/0/6/130603894/130603894.html#the+handmaid%27+s+tale+online+book+freeIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000015e8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15E8 | 7556 bytes |
SHA-256: 10c425fc1a1371ee4ba69a979062b9895bbe9a4803a2e9ccd88e11194812a6d7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.