MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the first identified link being http://eumelhor.org/uploads/1/3/0/2/130288661/0f96411.pdf. This suggests the document's primary purpose is to redirect users to a network of malicious sites, likely for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://eumelhor.org/uploads/1/3/0/2/130288661/0f96411.pdf In PDF document text
- http://periscopedigital.com.au/uploads/1/3/0/7/130776105/4294868.pdfIn PDF document text
- http://my-living-benefits.com/uploads/1/3/0/5/130540266/532838.pdfIn PDF document text
- http://www.sfitzsimmons.com/uploads/1/3/0/5/130589274/xunesi_fipedatodul_dojiwexajexutu_ronitekuba.pdfIn PDF document text
- http://donikamiller.com/uploads/1/3/0/4/130435577/4f6bf.pdfIn PDF document text
- http://btbrv.com/uploads/1/3/0/5/130551765/somidabubipaseja.pdfIn PDF document text
- http://newyorksocialpages.com/uploads/1/3/0/7/130739253/c7d3a8c8.pdfIn PDF document text
- http://mayaarchaeology.net/uploads/1/3/0/3/130313612/vupuwifal.pdfIn PDF document text
- http://hostmaster.hdasussexbranch.org.uk/uploads/1/3/0/4/130476157/luraratukat_katatikegorujax_vituzowinajoni.pdfIn PDF document text
- http://openguardsweeps.com/uploads/1/3/0/7/130776714/3167422.pdfIn PDF document text
- http://newyearswim.co.uk/uploads/1/3/0/6/130621248/2996895.pdfIn PDF document text
- http://pinepinestudio.net/uploads/1/3/0/3/130379105/tunoxon.pdfIn PDF document text
- http://milesandmccleanllc.com/uploads/1/3/0/7/130776434/22059.pdfIn PDF document text
- http://mjtservices.info/uploads/1/3/0/7/130739274/vijorakuwin-wawuk-vilezupowune.pdfIn PDF document text
- http://nstrajectory.org/uploads/1/3/0/3/130323227/2868093.pdfIn PDF document text
- http://genservicecontracting.gammaxiques.org/uploads/1/3/0/8/130813897/130813897.html#klasifikasi+gulma+amaranthus+spinosusIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000428b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x428B | 16036 bytes |
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
|||
font_01_sfnt_off0000598f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x598F | 7856 bytes |
SHA-256: 566268349a2f3066244f5a0729b276ed9db33934483b87563ea027cda11cf5ca |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.