MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://takeabowkilmarnock.com/uploads/1/3/0/7/130740141/rajetodakixevuwi.pdf In PDF document text
- http://newresume2019.com/uploads/1/3/0/6/130621352/d36c1ff7c45e.pdfIn PDF document text
- http://rimavop.store/uploads/1/3/0/5/130588426/nexanumesuru.pdfIn PDF document text
- http://timelessfinds.net/uploads/1/3/0/6/130620778/9e44bb7013.pdfIn PDF document text
- http://meditono.com/uploads/1/3/0/8/130814104/2549186.pdfIn PDF document text
- http://psyneways.com/uploads/1/3/0/6/130639685/lugipavojelino.pdfIn PDF document text
- http://www.boodwah.net/uploads/1/3/0/6/130605373/nitus_nozejogibiwojem.pdfIn PDF document text
- http://swag-walk.com/uploads/1/3/0/2/130287289/7176895.pdfIn PDF document text
- http://aprilbaskin.com/uploads/1/3/0/6/130620584/retobufugamog.pdfIn PDF document text
- http://orbitvetmap.net/uploads/1/3/0/6/130639023/681798.pdfIn PDF document text
- http://bufalo-verbena.com/uploads/1/3/0/7/130776182/9176078.pdfIn PDF document text
- http://countrymusicpromo.com/uploads/1/3/0/6/130640182/75a0e8.pdfIn PDF document text
- http://host2.sbrsd.org/uploads/1/3/0/7/130775027/d569ea04a5d7963.pdfIn PDF document text
- http://247cardetailing.com/uploads/1/3/0/4/130483067/disiw.pdfIn PDF document text
- http://pollyshulman.net/uploads/1/3/0/5/130543941/0a6beaaa9.pdfIn PDF document text
- http://rebeccahoulden.com/uploads/1/3/0/6/130621447/4c3028f34.pdfIn PDF document text
- http://mkbrooks.net/uploads/1/3/0/8/130814297/rumidafadelepapinak.pdfIn PDF document text
- http://laparc.co.za/uploads/1/3/0/8/130873786/rudibif.pdfIn PDF document text
- http://sweetsadiesdoggieboutiqueonline.com/uploads/1/3/0/2/130287463/798817.pdfIn PDF document text
- http://newwomanrebel.com/uploads/1/3/0/2/130289551/1405928.pdfIn PDF document text
- http://desvosges.com/uploads/1/3/0/5/130545932/diganivuf.pdfIn PDF document text
- http://wondertraveltours.xsideas.com/uploads/1/3/0/7/130739934/130739934.html#citric+acid+anhydrous+merck+coaIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002ed1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2ED1 | 8796 bytes |
SHA-256: 4e65f28d35d0fc7b25da9815c577674c99cd9269ba95cb4d4c913cf5f268fd03 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.