MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output strongly suggest malicious intent. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for malicious redirection or SEO spam.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://rurostelekomk.ru/uploads/2020/01/27/nukibixozaduwi.pdf
- http://vijariwu.salonhm.net/uploads/2020/01/28/cb30c2e212e3.pdf
- http://tesekadap.tdorestoran.ru/uploads/2020/01/27/1167520.pdf
- https://busufovemawut.weebly.com/uploads/1/3/0/4/130483184/dadawivef-kebobura-kavubozit.pdf
- http://4gkingdomliving.com/uploads/1/3/0/6/130620689/kenulijubaja.pdf
- http://mexicolegalhelp.com/uploads/1/3/0/6/130622116/bodalenupofez_tovelef.pdf
- http://muwazus.helpsinstagram.com/uploads/2020/01/28/1694193.pdf
- http://merryhillweddings.net/uploads/1/3/0/6/130639530/2042582.pdf
- http://mrandmrsmusicco.com/uploads/1/3/0/2/130289154/vorobuvagit.pdf
- http://fassil.online/uploads/2020/01/28/dokobibeb_jakanuwesesular_tezotipisit.pdf
- http://gereku.sunparkspb.com/uploads/2020/01/27/4605433.pdf
- https://pumugutan.weebly.com/uploads/1/3/0/2/130291596/rowaxeruvam.pdf
- http://suor.pt/uploads/1/3/0/5/130550844/1259281.pdf
- https://mojebuxarijewa.weebly.com/uploads/1/3/0/5/130589297/1b51ac81d60d.pdf
- http://numo.scinote.ru/uploads/2020/01/29/4323475.pdf
- http://mmjplantation.org/uploads/1/3/0/5/130539366/zixoluruwokaz.pdf
- http://simexomu.digitalein.com/uploads/2020/01/28/1110877.pdf
- http://50lutions.net/uploads/2020/01/27/zivobupaz_nojotugizizujo.pdf
- http://fovepexiwo.rucrime.top/uploads/2020/01/29/97eef354bc.pdf
- http://vabe.partizansk-vc.ru/uploads/2020/01/29/fafomaboze_wodanodukebi_favunutan.pdf
- http://ayurvedicprinciples.com/uploads/1/3/0/6/130621836/sotugibizux-juxubi-fijoxewof.pdf
- http://8danaroad.com/uploads/1/3/0/5/130588956/b79e761bacd4e.pdf
- http://flexbeat.pro/uploads/2020/01/28/aa27f85e.pdf
- http://qslam.com/uploads/1/3/0/6/130604340/2933361.pdf
- http://oakislandhomeowners.org/uploads/1/3/0/3/130313634/130313634.html#bootstrap+material+design+dashboard+template
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000017f3.bin508958f77dc81aa2eb33a921cc68b65eaebc04e334f8ff23645a44170141bcd9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17F3 | 8708 bytes |
font_01_sfnt_off0000c74c.bin669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC74C | 16180 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.