MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body text is heavily obfuscated and does not provide clear user-facing content, but the heuristic firings strongly indicate a malicious redirection scheme.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://drjeffbarone.com/uploads/1/3/0/6/130604350/fizak_gebomipifomaj_pojigosaw.pdf In PDF document text
- http://thebakerstualatin.com/uploads/1/3/0/4/130489833/xitagofexozopu_pizitodaj_wodugedurilawa.pdfIn PDF document text
- http://webmail.taypiping.co.uk/uploads/1/3/0/5/130543107/xaguw_xamatepejafigo_tubaw_nexokejowopi.pdfIn PDF document text
- http://christinareid.net/uploads/1/3/0/3/130323445/sowav-figakifugeruw.pdfIn PDF document text
- http://jurandirsilva.com/uploads/1/3/0/7/130740000/zovaxano.pdfIn PDF document text
- http://ivyfloralny.com/uploads/1/3/0/5/130590456/sevetorutum.pdfIn PDF document text
- http://smilesheal.org/uploads/1/3/0/6/130620345/masuzemop-jenamipupesob-gotemiz-welejixa.pdfIn PDF document text
- http://dmitrithompson.com/uploads/1/3/0/3/130324315/lenudiwetorumove.pdfIn PDF document text
- http://www.prince-harry-lookalike.com/uploads/1/3/0/8/130874591/pubegefob-jefibufew-zanivatoviwu.pdfIn PDF document text
- http://sparksrvpark.com/uploads/1/3/0/8/130874645/luwonegawetu.pdfIn PDF document text
- http://conifermountain.fun/uploads/1/3/0/5/130588315/718ec4e80.pdfIn PDF document text
- http://aworldinneed.org/uploads/1/3/0/7/130740340/8ec809dfd.pdfIn PDF document text
- http://nestandnookdesign.com/uploads/1/3/0/4/130436007/e5a01e24390c.pdfIn PDF document text
- http://www.eecmi.com/uploads/1/3/0/2/130271205/sojuwika.pdfIn PDF document text
- http://lilfaith.net/uploads/1/3/0/3/130313638/gawawajawug.pdfIn PDF document text
- http://www.iminctrl.net/uploads/1/3/0/8/130813827/967321.pdfIn PDF document text
- http://passantefinancial.com/uploads/1/3/0/2/130288629/pugibovimutuwi-lasolewavu.pdfIn PDF document text
- http://2014.financialpermaculture.com/uploads/1/3/0/7/130775025/kufoti.pdfIn PDF document text
- http://museodelacontabilidad.org/uploads/1/3/0/9/130969137/tigos.pdfIn PDF document text
- http://charmingplaces.be/uploads/1/3/0/4/130488429/c33b93ffab482b2.pdfIn PDF document text
- http://zdzz.brdge.org/uploads/1/3/0/9/130969327/130969327.html#adobe+acrobat+pro+freezes+when+combining+filesIn PDF document text
🗂 Part of campaign:
aworldinneed.org
3 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000179e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x179E | 6012 bytes |
SHA-256: 040b1b6515a69478eb06b3730da8dee43cd72804ec6e2b4704af177648ae419f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.