MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, with ClamAV specifically identifying it as 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs likely serve as a lure to phishing sites or to download further malicious payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://montanabridalshows.com/uploads/1/3/0/7/130739928/rolumovunuwina.pdf In PDF document text
- http://siobhanartandecology.com/uploads/1/3/0/6/130639973/5394469.pdfIn PDF document text
- http://strangenamedoc.com/uploads/1/3/0/5/130588315/wubomomofipevi.pdfIn PDF document text
- http://vigrinhotels.com/uploads/1/3/0/6/130621425/2293978.pdfIn PDF document text
- http://wellwellcreative.com/uploads/1/3/0/5/130540366/safesekejiri.pdfIn PDF document text
- http://nw1.me/uploads/1/3/0/4/130488574/0befe7708258ff.pdfIn PDF document text
- http://www.britishmountainacademy.com/uploads/1/3/0/5/130544147/74df1c11f5e54d.pdfIn PDF document text
- http://baymediaproductions.com/uploads/1/3/0/8/130874162/tobobixerapigibulaz.pdfIn PDF document text
- http://paymeprompt.net/uploads/1/3/0/6/130603793/xedagogedu.pdfIn PDF document text
- http://mikaren.com/uploads/1/3/0/5/130588718/dotusefe.pdfIn PDF document text
- http://eldersemporium.com/uploads/1/3/0/2/130274301/vifab.pdfIn PDF document text
- http://ichunes.com/uploads/1/3/0/7/130776609/cdeaf40e.pdfIn PDF document text
- http://333survival.com/uploads/1/3/0/4/130476778/ranuzeraren.pdfIn PDF document text
- http://adancerstouch.com/uploads/1/3/0/7/130739505/zepubezu.pdfIn PDF document text
- http://www.vote-for-our-schools.com/uploads/1/3/0/6/130620689/3755428.pdfIn PDF document text
- http://buildsolutionz.com/uploads/1/3/0/6/130603861/2586f57e.pdfIn PDF document text
- http://bygollycandlesnmore.com/uploads/1/3/0/5/130551331/luzexikusojagabonuno.pdfIn PDF document text
- http://sassyscraps.com.au/uploads/1/3/0/2/130271111/dolupilinateba.pdfIn PDF document text
- http://empire23.com/uploads/1/3/0/8/130813972/juner.pdfIn PDF document text
- http://core-transformation.org/uploads/1/3/0/4/130483809/ec6a425a4f.pdfIn PDF document text
- http://theharrishawkinshometeam.com/uploads/1/3/0/7/130739500/5277940.pdfIn PDF document text
- http://amjvy.slpny.com/uploads/1/3/0/7/130739322/130739322.html#rubrik+penilaian+akreditasi+paud+pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002ee4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2EE4 | 7396 bytes |
SHA-256: fef7818fab1d4ddc7b3dfabbd5cf9cdef6a518f20e81bfb9805eccb9ae9d1831 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.