MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the extensive link farm suggests a delivery mechanism for further malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 0.9953
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bbp-phnx1.intra.bradleybeachpd.com/uploads/1/3/0/2/130289424/cddee422c3c16b.pdf
- http://hostmaster.rgadesignquilts.com/uploads/1/3/0/6/130620845/kamifolaxonobobipun.pdf
- http://bimpliciti.net/uploads/1/3/0/5/130543667/2267885.pdf
- http://northhobby.us/uploads/1/3/0/6/130603997/wogikomilik-lokepunaremar-rekopixugere.pdf
- http://diamondviewfarms.com/uploads/1/3/0/4/130483862/3867473.pdf
- http://treemendousnursery.com/uploads/1/3/0/7/130775111/nonitimazemija-xegof-bopet.pdf
- http://dadevilleband.com/uploads/1/3/0/5/130590577/cf44141.pdf
- http://minhavidaminhasescolhas.com/uploads/1/3/0/2/130270863/xofigutu_wusex_jeruxamojiroj.pdf
- http://ddsdestinations.net/uploads/1/3/0/7/130775853/gezurekakiwu-bomasonimu.pdf
- http://jwlabs.dev/uploads/1/3/0/2/130287401/xiron.pdf
- http://www.browngirlfearless.com/uploads/1/3/0/5/130588843/robijesukuse_jovoja_lezofimisinu_vekorerajo.pdf
- http://sijitech.com/uploads/1/3/0/5/130539652/c51184720a407d.pdf
- http://hiyeller.com/uploads/1/3/0/7/130776075/018a8327f251221.pdf
- http://74-123-77-162.mgwnet.com/uploads/1/3/0/4/130436171/rikedumav-foxemagan-dapabawopil-paxobizixe.pdf
- http://affordableinsurancedirect.com/uploads/1/3/0/4/130488415/wakinazugin.pdf
- http://carrieandandrew.com/uploads/1/3/0/4/130494059/juburoxidibukez.pdf
- http://www.business-fedex.com/uploads/1/3/0/8/130874470/jenibanex_nunuvisogatujil_jadexov_serefo.pdf
- http://shit-facedshakespeare.com/uploads/1/3/0/5/130550768/229b38ccce632.pdf
- http://lifetunesonline.net/uploads/1/3/0/5/130589228/lejulolafefudi.pdf
- http://www.die-hexen-haus.com/uploads/1/3/0/8/130814706/jowatupudedikegi.pdf
- http://mta-sts.littleindiarestaurant.ca/uploads/1/3/0/3/130323186/dejenol.pdf
- http://mx.alare.net/uploads/1/3/0/7/130775431/8069922.pdf
- http://taxauctiontitle.com/uploads/1/3/0/6/130620551/1775951.pdf
- http://huangguanzuqiukaihuwang.br3h.com/uploads/1/3/0/7/130740112/130740112.html#kula+kundalini+shakti+jagran
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f666.bin1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF666 | 1388 bytes |
font_01_sfnt_off0000ffcf.bin9ad3ddc18670591ede612048015cb5ac4f539323284233c0d1957819b1a9fb8b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFCF | 6464 bytes |
font_02_sfnt_off00011ace.bin9121470d1a59b5408e38f359c80ce20d941b1430dcd6014d84793e282e6a40b0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11ACE | 20796 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.