MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning and phishing. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded links likely lead to further malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://amandamckelt.com/uploads/1/3/0/4/130436218/f8e6c.pdf In PDF document text
- http://lsgreenclean.com/uploads/1/3/0/6/130639669/8479573.pdfIn PDF document text
- http://www.alltexfab.com/uploads/1/3/0/4/130435893/lupojago_litug.pdfIn PDF document text
- http://princessponyclub.com/uploads/1/3/0/7/130738524/dasuso-zidelatapabo.pdfIn PDF document text
- http://craigsimonson.com/uploads/1/3/0/6/130620537/xagig-vilaririsebujo-kazudula-mepininefubidox.pdfIn PDF document text
- http://nerdysecretsinside.online/uploads/1/3/0/6/130620736/f3b01d.pdfIn PDF document text
- http://enchantedday.org/uploads/1/3/0/2/130288761/fuxutefojudem.pdfIn PDF document text
- http://www.jazzycolor.studio/uploads/1/3/0/7/130776599/4003690.pdfIn PDF document text
- http://yahonlytimes.com/uploads/1/3/0/5/130551491/dijopolesepem.pdfIn PDF document text
- http://bangkokrepublik.co/uploads/1/3/0/2/130273589/dugigebavupatoj_retixuwat.pdfIn PDF document text
- http://uteo.us/uploads/1/3/0/3/130313072/kosugo.pdfIn PDF document text
- http://mikacollins.com/uploads/1/3/0/4/130476605/bukimuselomodekuru.pdfIn PDF document text
- http://battagliaresearchgroup.org/uploads/1/3/0/2/130289535/tazurakisi.pdfIn PDF document text
- http://bridgetownbaroque.org/uploads/1/3/0/6/130604309/zipedakogemametozuj.pdfIn PDF document text
- http://millercounselingserv.com/uploads/1/3/0/7/130740066/gazijowesubafor.pdfIn PDF document text
- http://abcofxxx.com/uploads/1/3/0/7/130775440/8860176.pdfIn PDF document text
- http://bringmorehappy.com/uploads/1/3/0/4/130483146/gufosawopu.pdfIn PDF document text
- http://earthspiritpress.com/uploads/1/3/0/8/130814907/e1025238afc.pdfIn PDF document text
- http://www.mfundodazzling.com/uploads/1/3/0/7/130775897/saduxa.pdfIn PDF document text
- http://mfindia.org/uploads/1/3/0/6/130639895/7066930.pdfIn PDF document text
- http://www.astutepropertys.co.uk/uploads/1/3/0/7/130775643/3ab8bba6.pdfIn PDF document text
- http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/5/130538859/130538859.html#ancient+egyptian+symbols+and+their+meaningsIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003e1d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3E1D | 7472 bytes |
SHA-256: d938ed303effebdd43715e8acb9935041871d9fd07432bdc4b3bb98b9f3f7f36 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.