MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded URLs pointing to external PDF files, a pattern identified by the PDF_SEO_LINK_FARM heuristic. This suggests the document is designed to redirect users to a network of linked content, likely for malicious purposes such as SEO poisoning or distributing further malware. The ML classifier and ClamAV detection strongly support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://tryshashby-rolls.com/uploads/1/3/0/6/130639461/5820224.pdf In PDF document text
- http://www.tangovisions.be/uploads/1/3/0/6/130604678/vagaru.pdfIn PDF document text
- http://algrealproperties.com/uploads/1/3/0/8/130874391/weguvizokotedisaref.pdfIn PDF document text
- http://max.comppro.com/uploads/1/3/0/6/130603744/a87b1e.pdfIn PDF document text
- http://neeshazollinger.com/uploads/1/3/0/4/130490488/zixadino.pdfIn PDF document text
- http://jessicawcheung.com/uploads/1/3/0/8/130873971/lotosof.pdfIn PDF document text
- http://qor.kz/uploads/1/3/0/6/130621531/2472494.pdfIn PDF document text
- http://www.meetmoshe.com/uploads/1/3/0/7/130739153/cb538.pdfIn PDF document text
- http://staclaritasc.com/uploads/1/3/0/3/130323762/f6146b0.pdfIn PDF document text
- http://www.funredlabs.com/uploads/1/3/0/8/130814966/puresipefifen.pdfIn PDF document text
- http://autodiscover.oscilloscopemuseum.com/uploads/1/3/0/2/130291658/5329925.pdfIn PDF document text
- http://attiliosfarms.com/uploads/1/3/0/6/130605072/xorimopijet.pdfIn PDF document text
- http://letuscall.net/uploads/1/3/0/2/130272573/7335a7.pdfIn PDF document text
- http://smi-neurolab.org/uploads/1/3/0/5/130539940/voduxorap.pdfIn PDF document text
- http://petoskeydrones.com/uploads/1/3/0/7/130739828/vagunofe_nukatuk_razed_vibulukugo.pdfIn PDF document text
- http://ns.preservationdayton.com/uploads/1/3/0/6/130604882/fb21319336955.pdfIn PDF document text
- http://sales12-sip-phone.pleasingfood.com/uploads/1/3/0/8/130874055/130874055.html#outcomes+in+patients+with+adenoid+cystic+carcinoma+of+the+lacrimal+glandIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000337b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x337B | 2600 bytes |
SHA-256: 41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee |
|||
font_01_sfnt_off00003f4c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3F4C | 8828 bytes |
SHA-256: fc0ca4ffcccaf3c4a882e7593addf45e1122dbcc0a59925625aad1fd638bd39b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.