MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. These links point to various PDF files hosted on different domains, suggesting a campaign to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection further confirm the malicious nature of the file, with ClamAV identifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. No scripts were extracted, but the sheer volume of outbound links is the primary indicator of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.aquahunterscom.com/uploads/1/3/0/7/130775478/7bc29f6b.pdf
- http://diagmal.eu/uploads/1/3/0/5/130589396/7476822.pdf
- http://new.advicetotheplayers.org/uploads/1/3/0/3/130312965/koxoli_vozobejaki.pdf
- http://ohdearsboutique.com/uploads/1/3/0/5/130551805/9fb360.pdf
- http://ethosbeats.com/uploads/1/3/0/5/130588639/vekimakeroma_jinikosi.pdf
- http://www.truthinspiritbysandy.com/uploads/1/3/0/8/130874416/motuvigig.pdf
- http://1444harrison.com/uploads/1/3/0/6/130639939/09425c2530a7e0.pdf
- http://ovbeyondtherainbow.org/uploads/1/3/0/8/130814873/6587139.pdf
- http://www.hveheartlifestyle.com/uploads/1/3/0/2/130272856/ruluvinuvikam_fiziji.pdf
- http://mta-sts.mail.sandyblaisdell.com/uploads/1/3/0/2/130288506/funupegafov.pdf
- http://rqgenesis.co/uploads/1/3/0/2/130289480/8cf63dfb3fbc1f0.pdf
- http://suekennedycelebrant.com/uploads/1/3/0/3/130379194/kojodazipoxawem-kevuvelelasu-kowukopet-kizudovolewoj.pdf
- http://nelsonfirm.com/uploads/1/3/0/6/130621055/729076e524b709.pdf
- http://nfstoryboard.com/uploads/1/3/0/4/130488067/3f15ddd7a8488f7.pdf
- http://ctshakerfurniture.com/uploads/1/3/0/7/130739343/melugupafebofa_pugisobikiniwug_gavud_fekizopovel.pdf
- http://laboratoriodemateriales.net/uploads/1/3/0/7/130738641/5706337.pdf
- http://towriteforyou.com/uploads/1/3/0/3/130313170/vizoju.pdf
- http://www.hummobile.co/uploads/1/3/0/4/130483565/8496188.pdf
- http://5pointauto.com/uploads/1/3/0/6/130639545/662895.pdf
- http://neurology-u-tokyo.com/uploads/1/3/0/6/130621909/71acac.pdf
- http://thankheaven.com/uploads/1/3/0/4/130476322/fozotati.pdf
- http://calkdr.net/uploads/1/3/0/2/130287281/wupafunusimakusa.pdf
- http://www.lynnettewatson.com/uploads/1/3/0/5/130543168/130543168.html#affairs+cloud+current+affairs+july+2
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001157.binb093ce5ef1d5db3a6f6f3c6a73b1693144b545a2666eab275fbc1553a0d3bcd4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1157 | 9092 bytes |
font_01_sfnt_off00009325.bine8e9a771120ddc844b49d5030f21ea4a5c65a49c56b3921c8cd14080325ef1aa |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9325 | 2728 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.