MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0. The primary function appears to be directing users to a vast collection of other PDF files hosted on numerous domains, likely for malicious purposes such as SEO poisoning or distributing further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://damaebanisteria.com/uploads/1/3/0/6/130605263/3467709.pdf In PDF document text
- http://www.colorfulmodern.com/uploads/1/3/0/7/130738591/zawipa.pdfIn PDF document text
- http://botoxduluth.com/uploads/1/3/0/7/130775297/9500864.pdfIn PDF document text
- http://cpanel.cascadebga.org/uploads/1/3/0/6/130639357/razokapumalogakal.pdfIn PDF document text
- http://www.luther2017.org/uploads/1/3/0/4/130488834/remolop.pdfIn PDF document text
- http://danaroberts.com/uploads/1/3/0/5/130588740/mumijejaf-baragevugegag-bofibagenezuvo.pdfIn PDF document text
- http://janeflegal.com/uploads/1/3/0/5/130539652/nibud.pdfIn PDF document text
- http://abundantlifecog.net/uploads/1/3/0/7/130775361/nozidi_xudivorufovugof.pdfIn PDF document text
- http://silverarcherdesigns.com/uploads/1/3/0/3/130323601/nefagokun.pdfIn PDF document text
- http://cemento-stampato.org/uploads/1/3/0/6/130621698/xorogugarig-kerazok.pdfIn PDF document text
- http://albara4u.com/uploads/1/3/0/5/130550983/xupuzimipoges.pdfIn PDF document text
- http://dns1.rubenslamel.com/uploads/1/3/0/8/130813991/duveto_rewazobofu_mobofitumur_marepubanuga.pdfIn PDF document text
- http://ddiamondco.com/uploads/1/3/0/7/130739379/jugunewazedu.pdfIn PDF document text
- http://hostmaster.zingezong.com/uploads/1/3/0/8/130874655/zopakozexo.pdfIn PDF document text
- http://bohojane.com/uploads/1/3/0/7/130775164/71ce35a.pdfIn PDF document text
- http://stop-n-smelltheflowers.com/uploads/1/3/0/6/130620763/makolujudedejabijuna.pdfIn PDF document text
- http://myescondidosoccer.com/uploads/1/3/0/4/130475955/dipopiga.pdfIn PDF document text
- http://webdisk.xebex.eu/uploads/1/3/0/6/130605019/8070092.pdfIn PDF document text
- http://islandscast.com/uploads/1/3/0/8/130874143/5308948.pdfIn PDF document text
- http://www.panduct.com/uploads/1/3/0/2/130271113/fibibiwoxifinix.pdfIn PDF document text
- http://extentrics.com/uploads/1/3/0/4/130483288/4580390.pdfIn PDF document text
- http://harrisonashtonphoto.com/uploads/1/3/0/5/130540085/f41e4fb19224c.pdfIn PDF document text
- http://taiyangchengyulewang888ya.br3h.com/uploads/1/3/0/6/130603842/130603842.html#online+unicode+hindi+typing+test+remington+keyboardIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003255.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3255 | 8664 bytes |
SHA-256: d24dbdf357729008218e53e6619941fe87146988c8cb5017a7c1158471ec3b8b |
|||
font_01_sfnt_off00004c8d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C8D | 8556 bytes |
SHA-256: dcb05807abfffaebab1386e3798b0cab0a98394977d664f1624ac0fdaa3ad1f8 |
|||
font_02_sfnt_off00006944.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6944 | 16036 bytes |
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.