MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing attempt. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the first identified as http://megadromlabs.com/uploads/1/3/0/6/130640062/9197251.pdf. This suggests the document's primary purpose is to redirect users to potentially harmful websites, possibly for SEO manipulation or to serve further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://megadromlabs.com/uploads/1/3/0/6/130640062/9197251.pdf In PDF document text
- http://computatumservices.net/uploads/1/3/0/5/130551247/bizoletowixap.pdfIn PDF document text
- http://hustleandheartbeauty.com/uploads/1/3/0/2/130289623/gujeladefuxako_mogutopavik_jiluxasewesotok.pdfIn PDF document text
- http://nobleberean.com/uploads/1/3/0/9/130969436/798fd0d0.pdfIn PDF document text
- http://northerncoloradofarrier.com/uploads/1/3/0/5/130551739/40f19f641f8c.pdfIn PDF document text
- http://comedywonder.com/uploads/1/3/0/2/130289630/nisedifavekorozifu.pdfIn PDF document text
- http://northshoreengineeringny.com/uploads/1/3/0/3/130323127/ced19583cc9.pdfIn PDF document text
- http://runawaytidegeneralstore.com/uploads/1/3/0/2/130272886/puluvo_kometadevutojep.pdfIn PDF document text
- http://sonyakrakoff.com/uploads/1/3/0/2/130288986/5612607.pdfIn PDF document text
- http://mycastlemanagement.com/uploads/1/3/0/2/130289729/8793502.pdfIn PDF document text
- http://4550preslyn.com/uploads/1/3/0/5/130588672/riwimadusus_debesep_pupifigosepat.pdfIn PDF document text
- http://postmaster.iki-cc.jp/uploads/1/3/0/5/130551041/pugil_defax_lasun.pdfIn PDF document text
- http://pdvintage.com/uploads/1/3/0/5/130589397/jukexusezo.pdfIn PDF document text
- http://harold-stanley-junior.pleasingfood.com/uploads/1/3/0/6/130639317/130639317.html#b.ed+books+in+gujarati+pdf+free+downloadIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003141.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3141 | 16224 bytes |
SHA-256: da097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572 |
|||
font_01_sfnt_off00004618.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4618 | 2228 bytes |
SHA-256: 236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff |
|||
font_02_sfnt_off00005128.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5128 | 15380 bytes |
SHA-256: b12b7f18d280f193b5a02fbfa6a666316a55e435374b0561dc14226347eb6da3 |
|||
font_03_sfnt_off00007be0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7BE0 | 8388 bytes |
SHA-256: 01684ad5fad16f825ec5028310f1dd9e46e07eab26c7734ffc376e742848527b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.