MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', reinforcing its malicious nature. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further indicates a lure to encourage user interaction with the embedded links.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://solarenergybrokerinc.com/uploads/1/3/0/5/130588279/botekorov-gumaz-welosavifupupan.pdf
- http://jamesmustafa.com/uploads/1/3/0/8/130874389/mumeganekege.pdf
- http://bottegavesuviana.com/uploads/1/3/0/2/130289448/f624a7d89.pdf
- http://mindbodyhealthcoaching.com.au/uploads/1/3/0/5/130550681/2525537.pdf
- http://www.carlyberg.com/uploads/1/3/0/3/130313161/9879478.pdf
- http://heythatsagreatidea.com/uploads/1/3/0/3/130313471/vebojuwetera-ledijav.pdf
- http://www.catch5alive.com/uploads/1/3/0/3/130323479/zanodowudakuv.pdf
- http://thechurchchoirloft.com/uploads/1/3/0/5/130539446/305975.pdf
- http://fakeangels.space/uploads/1/3/0/7/130739143/vilixekabobij-povur.pdf
- http://www.sense-mindful.com/uploads/1/3/0/6/130605012/33de8ed0c01.pdf
- http://pitwagner.com/uploads/1/3/0/8/130874536/871322.pdf
- http://online-wealth-college.com/uploads/1/3/0/2/130270903/69b85.pdf
- http://daniel-stripedtiger.com/uploads/1/3/0/2/130291783/4506181.pdf
- http://neurology-u-tokyo.com/uploads/1/3/0/7/130775904/buvivalokurafedu.pdf
- http://tirus.io/uploads/1/3/0/5/130551562/fodamuvaroxa.pdf
- http://mrsrosatosclass.com/uploads/1/3/0/3/130323437/refagaz.pdf
- http://thewaves.site/uploads/1/3/0/9/130969278/tevuwidizotuzikolinu.pdf
- http://wavradio.org/uploads/1/3/0/6/130640091/779674.pdf
- http://quantuminstruments.com/uploads/1/3/0/8/130813373/ec125d16.pdf
- http://huangguanwangxiazhujidian.f18.ebkf.org/uploads/1/3/0/6/130605440/tabupaza-gukogugos.pdf
- http://animalcomeback.com/uploads/1/3/0/6/130621191/5681481.pdf
- http://a1982767xstreamtravel.xsideas.com/uploads/1/3/0/3/130313336/130313336.html#kaplan+f5+revision+kit+2018
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003c8d.bin696bdcee8fbc902021214a3f19b685da097fb690f390baee6290127e8b477be5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C8D | 18060 bytes |
font_01_sfnt_off0000583c.bin17c16ceb714385a5d8506e469f96300699ff97667f077ddd4d29b41a33b7472b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x583C | 15784 bytes |
font_02_sfnt_off00007e73.bin9c3812b1e2b75f09abe844c6e7fe5e6a65d6b42e2211a549512a161182d83f6b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7E73 | 8552 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.