MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics, including a critical rule for a large external PDF link farm and a machine learning classifier indicating high maliciousness. ClamAV also detected it as Pdf.Phishing.TtraffRobotInstall. The numerous embedded URLs suggest a phishing or spam campaign, potentially aiming to redirect users to malicious sites or to manipulate search engine results. No scripts were extracted, but the structure strongly indicates a malicious intent to distribute content via external links.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://silhomes.com/uploads/1/3/0/3/130324357/05cc4c.pdf In PDF document text
- http://teamelite10u.com/uploads/1/3/0/8/130813510/lewuxudafusimuf.pdfIn PDF document text
- http://thesaltcollective.net/uploads/1/3/0/4/130476086/subuluzuposefi_getavegabatidod.pdfIn PDF document text
- http://mindfullmug.com/uploads/1/3/0/5/130545885/8f3551cae57.pdfIn PDF document text
- http://sugarmaplecharcoal.com/uploads/1/3/0/3/130379415/sonupolobozemilala.pdfIn PDF document text
- http://notasportsbar.ca/uploads/1/3/0/5/130588463/7395b3.pdfIn PDF document text
- http://wpdogs.com/uploads/1/3/0/7/130740192/nefeloramez.pdfIn PDF document text
- http://thecrunchyconservative.com/uploads/1/3/0/4/130483322/vuwaganiwidadon_piwazeduto_wikusok.pdfIn PDF document text
- http://mictkinofest.com/uploads/1/3/0/2/130272640/gobuxatubedemavase.pdfIn PDF document text
- http://nickgrossman.net/uploads/1/3/0/7/130739141/6a1f4c7e94a7b.pdfIn PDF document text
- http://vxserver.org/uploads/1/3/0/3/130323115/4d68186.pdfIn PDF document text
- http://globalwaronchristmas.com/uploads/1/3/0/8/130874031/602243.pdfIn PDF document text
- http://kkompani.com/uploads/1/3/0/3/130323362/1680996.pdfIn PDF document text
- http://covenantfellowshipchurches.org/uploads/1/3/0/6/130621545/5030799.pdfIn PDF document text
- http://suncityprides.org/uploads/1/3/0/4/130476440/rukenigod-virogupux-vuluvafef-nasipobobuvuwa.pdfIn PDF document text
- http://volumesalon.global/uploads/1/3/0/7/130774990/4b58cd03.pdfIn PDF document text
- http://3dstereopad.com/uploads/1/3/0/7/130775698/davawajimu_ramituge_puxilabi.pdfIn PDF document text
- http://911snowremoval.com/uploads/1/3/0/6/130605116/xubizovonukikese.pdfIn PDF document text
- http://snapshotsofwisdom.com/uploads/1/3/0/6/130604605/925f7ad21e2dc.pdfIn PDF document text
- http://bransfordmedpsych.com/uploads/1/3/0/8/130813757/1f7560ad27.pdfIn PDF document text
- http://2020blue.org/uploads/1/3/0/5/130541209/130541209.html#report+writing+format+sample+pdfIn PDF document text
🗂 Part of campaign:
arapaho-massage.com
15 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003a90.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3A90 | 7440 bytes |
SHA-256: 78c82dfdb4c1b22fe8bd6b0156093868f943d620622d63b7a434640a3f311bce |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.