MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule, indicating a large number of external links. The ML classifier also assigned a high probability of maliciousness. The embedded URLs, such as http://sunujuri.sampstealer.xyz/uploads/2020/01/27/fowapokosedut_julozozo_puxoxipu_gegutomidafo.pdf, are likely used to redirect users to phishing sites or download further malware. The document body contains a mix of seemingly random text and URLs, further supporting a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://sunujuri.sampstealer.xyz/uploads/2020/01/27/fowapokosedut_julozozo_puxoxipu_gegutomidafo.pdf In PDF document text
- http://chwichen.com/uploads/2020/01/27/16126195296cc.pdfIn PDF document text
- http://dasekun.indasoft.online/uploads/2020/01/29/zugagexaj.pdfIn PDF document text
- http://juvevizen.dom63.su/uploads/2020/01/27/5ae0c7b.pdfIn PDF document text
- http://xilodagupu.huaweinew.ru/uploads/2020/01/28/fufedemider_musakelekiwido.pdfIn PDF document text
- http://vaxexu.in-op.fun/uploads/2020/01/28/6810761.pdfIn PDF document text
- http://fiwimarketing.com/uploads/1/3/0/5/130588442/dewajisazasin_diwov_lazet_senivifemefom.pdfIn PDF document text
- http://fob.1amulet.ru/uploads/2020/01/28/19f69c9d.pdfIn PDF document text
- http://ecsog.ru/uploads/2020/01/29/3158103.pdfIn PDF document text
- http://natcha.online/uploads/2020/01/28/junegeda.pdfIn PDF document text
- http://mycambodonuts.com/uploads/1/3/0/4/130476255/jepuwomonezuruvi.pdfIn PDF document text
- http://kisepifi.masterpechi.ru/uploads/2020/01/27/dopovenosim-najuzeti-vijavovika.pdfIn PDF document text
- http://atlfoodista.com/uploads/1/3/0/6/130604547/tagiwewaketidas.pdfIn PDF document text
- https://bewesojus.weebly.com/uploads/1/3/0/6/130603929/vurubiramija.pdfIn PDF document text
- https://pixufasaru.weebly.com/uploads/1/3/0/6/130603975/wadasuxoxujo_tajol.pdfIn PDF document text
- http://badasscoinrings.com/uploads/1/3/0/3/130323286/mupeka_lupumulafaroku.pdfIn PDF document text
- http://myloveclub.ru/uploads/2020/01/28/3d527.pdfIn PDF document text
- https://sileniwatagofos.weebly.com/uploads/1/3/0/4/130483629/tusefux_genonedobewa.pdfIn PDF document text
- http://bsa-sccc-pack301.com/uploads/1/3/0/4/130483520/130483520.html#naughty+neighbor+magIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001501.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1501 | 7928 bytes |
SHA-256: 2e9a528384845b449a612b19760e520e97975307f19bb1c784340c3fd3dfb94d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.