MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, for malicious content. The critical PDF_SEO_LINK_FARM heuristic indicates a large number of embedded external links, with the primary domain being 897788976207812023.com. The document body also contains numerous URLs, reinforcing the finding of a link farm designed to redirect users to potentially malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://897788976207812023.com/uploads/1/3/0/5/130544541/62a90702cc5.pdf
- http://akashachamberlain.com/uploads/1/3/0/6/130621533/0dac42.pdf
- http://capecodcoastalhomeinsurance.com/uploads/1/3/0/2/130291433/4aa19dd06b66125.pdf
- http://labeautephotographie.com/uploads/1/3/0/5/130540664/demarisewafilom.pdf
- http://lovelaughterandreallife.com/uploads/1/3/0/3/130379824/tolubesojatat_mapod_xojomunagunom.pdf
- http://newzineland.weebly.com/uploads/1/3/0/4/130435780/ddf3278c03f37af.pdf
- http://portcityseafoodsc.com/uploads/1/3/0/5/130589411/wujofovod.pdf
- http://gumipeno.pharmaexpo.tech/uploads/2020/01/28/fibexowajularojul.pdf
- http://nowator.eu/uploads/1/3/0/6/130604566/gonoxazok-tevunazuxiten.pdf
- http://nashvillemobilepetgrooming.com/uploads/1/3/0/6/130639228/kawanadalujasufetok.pdf
- http://midnighttokerstore.com/uploads/1/3/0/5/130541623/9776055.pdf
- http://mondesubtil.com/uploads/1/3/0/4/130478205/79d5725.pdf
- http://dimitrisdalakoglou.weebly.com/uploads/1/3/0/6/130639181/jizamukulowajuk.pdf
- http://strozzistawzeeh.com/uploads/1/3/0/2/130272886/xivuz_jofepubuluwan_sujokazokazezaf_rezajuki.pdf
- http://wallbrosdrywallservices.com/uploads/1/3/0/2/130289494/papaxikikug_ragazerewazekog.pdf
- http://msdanielteaches.com/uploads/1/3/0/2/130288684/wutazugirokudaj.pdf
- http://whimsicalpigs.com/uploads/1/3/0/5/130543333/7a4e4ddec373.pdf
- http://kinevib.finresult.com/uploads/2020/01/27/xinurimujikozuvufo.pdf
- http://threecreekaussies.com/uploads/1/3/0/5/130588905/3224225.pdf
- https://bunekolu.weebly.com/uploads/1/3/0/5/130539101/viwoketumosam_vezim_febafexuwerij_zuvopoxavug.pdf
- http://kardaautomotive.com/uploads/1/3/0/6/130621790/kutivowivutuf-xebujenupejed-wofipoxebaxul-bamuz.pdf
- https://mudanezuk.weebly.com/uploads/1/3/0/2/130270917/1132980.pdf
- http://xavuvi.smpix.ru/uploads/2020/01/28/0b43836ce9.pdf
- http://planetarydrive.org/uploads/1/3/0/6/130605355/130605355.html#german+relative+pronouns+worksheet
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001837.binc4a4964b47071f77360ce078d6fccd333cd6f7d24bbc5a5351d0eddee971fed8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1837 | 9448 bytes |
font_01_sfnt_off000064c9.bin669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x64C9 | 16180 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.