MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a critical PDF_SEO_LINK_FARM alert. The document body contains a large number of embedded URLs, with the primary domain being 'betasproject.online'. These links are likely used to redirect users to phishing sites or download further malicious content, aligning with a phishing attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://betasproject.online/uploads/2020/01/28/5749507.pdf
- http://keneni.speacetech.us/uploads/2020/01/27/b4d63a4.pdf
- http://oratio.ca/uploads/1/3/0/6/130603688/f4e2acd.pdf
- http://davidmazurphoto.com/uploads/2020/01/27/8bd5290.pdf
- http://concentricoperationsgroup.com/uploads/1/3/0/6/130620955/vanoxi.pdf
- http://pamavi.nttrus.com/uploads/2020/01/28/1837155.pdf
- http://hectormaxwell3d.com/uploads/1/3/0/5/130588487/pigesukul.pdf
- https://xulasijowe.weebly.com/uploads/1/3/0/5/130547038/vafij_mikorevenixizaz_xufolisosenus.pdf
- http://azucarpanela.com/uploads/2020/01/29/sifupawevolekigudu.pdf
- http://greyghosttac.com/uploads/1/3/0/6/130603783/2638d984b7848.pdf
- http://jakibatoru.wpchoice.net/uploads/2020/01/28/wejobimewisane.pdf
- http://nichellerenee.solutions/uploads/1/3/0/2/130270869/2618120.pdf
- http://shadelandcommercepark.com/uploads/1/3/0/6/130604556/kegopifux_luxedemosu_potesabiditu.pdf
- https://wozilobi.weebly.com/uploads/1/3/0/2/130272551/2bc9e8f82a6cd.pdf
- http://butlerandwood.com/uploads/1/3/0/2/130287521/dareriwid_jufolosajoz_bifisegow_dixivu.pdf
- http://volip.eosplit.ru/uploads/2020/01/28/lotazufefa.pdf
- http://geravutuk.sunparkspb.com/uploads/2020/01/29/nalarero.pdf
- http://zazize.botanicart.ru/uploads/2020/01/27/5881961.pdf
- https://joxabazebuzika.weebly.com/uploads/1/3/0/5/130545365/kikata.pdf
- http://managedbylvtn.com/uploads/1/3/0/5/130551991/1355367.pdf
- http://jesseflynnlaw.com/uploads/1/3/0/2/130272290/sitiralepugefef-mubuguvob.pdf
- https://wulumevidozida.weebly.com/uploads/1/3/0/4/130476594/dfd6b.pdf
- http://blackburnmarketers.com/uploads/1/3/0/4/130436130/f06ab04d276.pdf
- http://pob.gruzodelov.ru/uploads/2020/01/28/4addfec451.pdf
- http://stmarysoccer.com/uploads/1/3/0/6/130620547/3614565.pdf
- http://kevindalymusic.com/uploads/1/3/0/6/130604294/130604294.html#west+side+story+maria+piano+sheet+music
- http://pob.gruzodelov.ru/uploads/2020/01/28/4addfec451.p
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001768.bin98e8f13eaa9cbc51ef6435e9070f75743b9aaeb5d0f47730c57d3ac42e05876d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1768 | 8404 bytes |
font_01_sfnt_off000058f4.bin062abeeb0630068c9ebda4cd69880ba7d22c023ef851e82e77d1a768bfa0705b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x58F4 | 17648 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.