MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF file contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as a phishing-related malware. The document body, though heavily obfuscated, contains URLs that are part of this link farm. The primary attack pattern appears to be directing users to a network of linked PDF documents, likely for SEO spam or to serve as a distribution point for further malicious payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://monartisticpet.com/uploads/1/3/0/4/130490155/xorusimevipote.pdf In PDF document text
- http://jioulian.com/uploads/1/3/0/5/130543198/zegevesika.pdfIn PDF document text
- http://fegajed.americanadeidiomas.com/uploads/2020/01/29/4c8edda7.pdfIn PDF document text
- https://sepufaxekamop.weebly.com/uploads/1/3/0/2/130271114/dazuw.pdfIn PDF document text
- http://nextripchile.com/uploads/1/3/0/5/130551962/wiranojawin-silate-rapefetamaloval.pdfIn PDF document text
- http://northwestpetsupplies.com/uploads/1/3/0/6/130621385/6932860.pdfIn PDF document text
- http://milub.olikx.xyz/uploads/2020/01/27/sunuganiguraf.pdfIn PDF document text
- https://tuloxakinusen.weebly.com/uploads/1/3/0/4/130483412/8102254.pdfIn PDF document text
- http://maxoteb.ceodentvicalvaro.com/uploads/2020/01/28/zuxusafowisifepevi.pdfIn PDF document text
- https://bafonaxewul.weebly.com/uploads/1/3/0/2/130272600/7095126.pdfIn PDF document text
- http://ebc3.org/uploads/1/3/0/4/130489371/5810144.pdfIn PDF document text
- http://jdstom.ru/uploads/2020/01/27/mekuk-gidolibemalila.pdfIn PDF document text
- http://deniliv.e7ernall.pw/uploads/2020/01/27/3134703.pdfIn PDF document text
- http://jaecstore.com/uploads/1/3/0/2/130288479/tufuv.pdfIn PDF document text
- http://misssampson.com/uploads/1/3/0/3/130379051/lusutozafoko-kovukomebon-ruwewerolise.pdfIn PDF document text
- http://firstmedicalequipments.com/uploads/1/3/0/3/130379522/7750458.pdfIn PDF document text
- http://siluk.audiostart62.icu/uploads/2020/01/29/ziraz.pdfIn PDF document text
- http://shannanstanciuforschoolboard.com/uploads/1/3/0/4/130490221/xonawowivomev-xezojumos-joriv.pdfIn PDF document text
- http://work-ok.ru/uploads/2020/01/27/c7c3793d5a83.pdfIn PDF document text
- http://confidentbusinesssuport.com/uploads/2020/01/27/63a799e7af3f8.pdfIn PDF document text
- http://chrisreidstudio.net/uploads/1/3/0/4/130479123/wokegava.pdfIn PDF document text
- http://fodozu.tele2store.ru/uploads/2020/01/28/miluseka.pdfIn PDF document text
- http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/6/130621248/130621248.html#fraction+worksheets+for+3rd+grade+worksheetIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000109f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109F | 7860 bytes |
SHA-256: 0e25a13c6c8a07e428e200f5b2305500407516ef4c5895888190b86341ac2564 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.