MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded external links, a technique commonly used to redirect users to malicious websites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The embedded URLs point to various domains, all appearing to host PDF files, suggesting a link farm designed to distribute malicious content or lead to phishing pages.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://damaebanisteria.com/uploads/1/3/0/6/130605263/3467709.pdf
- http://www.colorfulmodern.com/uploads/1/3/0/7/130738591/zawipa.pdf
- http://botoxduluth.com/uploads/1/3/0/7/130775297/9500864.pdf
- http://cpanel.cascadebga.org/uploads/1/3/0/6/130639357/razokapumalogakal.pdf
- http://www.luther2017.org/uploads/1/3/0/4/130488834/remolop.pdf
- http://danaroberts.com/uploads/1/3/0/5/130588740/mumijejaf-baragevugegag-bofibagenezuvo.pdf
- http://janeflegal.com/uploads/1/3/0/5/130539652/nibud.pdf
- http://abundantlifecog.net/uploads/1/3/0/7/130775361/nozidi_xudivorufovugof.pdf
- http://silverarcherdesigns.com/uploads/1/3/0/3/130323601/nefagokun.pdf
- http://cemento-stampato.org/uploads/1/3/0/6/130621698/xorogugarig-kerazok.pdf
- http://albara4u.com/uploads/1/3/0/5/130550983/xupuzimipoges.pdf
- http://dns1.rubenslamel.com/uploads/1/3/0/8/130813991/duveto_rewazobofu_mobofitumur_marepubanuga.pdf
- http://ddiamondco.com/uploads/1/3/0/7/130739379/jugunewazedu.pdf
- http://hostmaster.zingezong.com/uploads/1/3/0/8/130874655/zopakozexo.pdf
- http://bohojane.com/uploads/1/3/0/7/130775164/71ce35a.pdf
- http://stop-n-smelltheflowers.com/uploads/1/3/0/6/130620763/makolujudedejabijuna.pdf
- http://myescondidosoccer.com/uploads/1/3/0/4/130475955/dipopiga.pdf
- http://webdisk.xebex.eu/uploads/1/3/0/6/130605019/8070092.pdf
- http://islandscast.com/uploads/1/3/0/8/130874143/5308948.pdf
- http://www.panduct.com/uploads/1/3/0/2/130271113/fibibiwoxifinix.pdf
- http://extentrics.com/uploads/1/3/0/4/130483288/4580390.pdf
- http://harrisonashtonphoto.com/uploads/1/3/0/5/130540085/f41e4fb19224c.pdf
- http://taiyangchengyulewang888ya.br3h.com/uploads/1/3/0/6/130603842/130603842.html#online+unicode+hindi+typing+test+remington+keyboard
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003255.bind24dbdf357729008218e53e6619941fe87146988c8cb5017a7c1158471ec3b8b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3255 | 8664 bytes |
font_01_sfnt_off00004c8d.bindcb05807abfffaebab1386e3798b0cab0a98394977d664f1624ac0fdaa3ad1f8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C8D | 8556 bytes |
font_02_sfnt_off00006944.bin779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6944 | 16036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.