MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on numerous domains, suggesting a coordinated effort to distribute content or manipulate search engine results. The ML classifier and ClamAV detection further support the malicious nature of this file, flagging it as phishing-related. No scripts were extracted, and the document body was heavily obfuscated and truncated, preventing a deeper analysis of its specific intent beyond link distribution.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ditazolun.weebly.com/uploads/1/3/0/2/130289386/vitizopit.pdf In PDF document text
- http://silexor.solomonka.online/uploads/2020/01/27/42c1a1245.pdfIn PDF document text
- http://dug.copyrightcontact-10000671253681.com/uploads/2020/01/28/ebdeef16f9ae04.pdfIn PDF document text
- https://dorawufufesa.weebly.com/uploads/1/3/0/2/130274282/fikegatipa_jimikumeribuvu_nizumiromusibo_saketuki.pdfIn PDF document text
- http://sibawexar.3ndfl-nalogi.ru/uploads/2020/01/27/fepatoninus_vabuzi_temoledij_lomekofefodajak.pdfIn PDF document text
- http://geweka.ib-airbank.mobi/uploads/2020/01/27/sodepibifu-jeliwaxewe-farugun.pdfIn PDF document text
- http://probiu.pro/uploads/2020/01/27/novibom.pdfIn PDF document text
- https://nolofaladigonad.weebly.com/uploads/1/3/0/3/130323959/xedeja-rowaxude-wutej-pijadosikekebed.pdfIn PDF document text
- http://teju.miradorbascamao.com/uploads/2020/01/28/e3a38f9fc0.pdfIn PDF document text
- https://sibizojun.weebly.com/uploads/1/3/0/5/130542863/ee00cb86a.pdfIn PDF document text
- http://guxadurek.goodbreak.ru/uploads/2020/01/28/3860589.pdfIn PDF document text
- http://vekeb.imperium.bz/uploads/2020/01/28/jalezezoragobenufote.pdfIn PDF document text
- https://resemaxolin.weebly.com/uploads/1/3/0/2/130288565/wigoxetoxilawe.pdfIn PDF document text
- http://sefobelu.supletivolitoral.com/uploads/2020/01/27/xokufos.pdfIn PDF document text
- http://vunigakul.camby.ru/uploads/2020/01/28/6047739.pdfIn PDF document text
- http://padiruzike.vipdating.icu/uploads/2020/01/28/kanagokude.pdfIn PDF document text
- https://rowolokogugi.weebly.com/uploads/1/3/0/3/130323131/powujoxirurazul.pdfIn PDF document text
- http://jeka.vipiski-online29.icu/uploads/2020/01/28/sezemelasopopujuxile.pdfIn PDF document text
- https://morarafaf.weebly.com/uploads/1/3/0/5/130590224/130590224.html#niosh+respirable+dust+standardIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001581.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1581 | 7760 bytes |
SHA-256: 440e50b9d45ff955700c2b537073a39d766409bdd2ed25896949fbce101b3d19 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.