MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document was flagged by multiple heuristics, including a critical finding for a mass external PDF link farm and ClamAV detection as Pdf.Phishing.TtraffRobotInstall. The embedded URLs, which are numerous and point to various domains, strongly suggest a phishing or malware distribution campaign. The document body contains garbled text and embedded URLs, further supporting the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://wumakajav.weebly.com/uploads/1/3/0/3/130379228/6067303.pdf In PDF document text
- http://vevolip.splashvision.online/uploads/2020/01/28/migoxedij_letefonuxevux_dugabulonixu_sipine.pdfIn PDF document text
- http://fafiredino.baikalist.com/uploads/2020/01/27/4949321.pdfIn PDF document text
- https://vuvajopipebojix.weebly.com/uploads/1/3/0/6/130603978/jomozabakusulo-bukutepapuxej.pdfIn PDF document text
- http://takunuxogo.banglanews.pro/uploads/2020/01/27/xejetunupewu-tufeto.pdfIn PDF document text
- http://fugotujiwe.vetrics.ru/uploads/2020/01/28/380569.pdfIn PDF document text
- http://vv6vv.top/uploads/2020/01/28/f7d6db57a.pdfIn PDF document text
- http://carllarosa.com/uploads/1/3/0/5/130543264/mebanavuviku_woxatovexabo_dodikabixevi_susobuze.pdfIn PDF document text
- http://kloconsulting.us/uploads/1/3/0/3/130379407/samiralitij_fesupozuge.pdfIn PDF document text
- http://reidislandwoodworks.ca/uploads/1/3/0/5/130540585/biwonekegamiruw.pdfIn PDF document text
- https://devofalafuzami.weebly.com/uploads/1/3/0/5/130547659/xefonefebo.pdfIn PDF document text
- https://ludiroros.weebly.com/uploads/1/3/0/2/130291029/mizitu-juser-wosojasinoter.pdfIn PDF document text
- http://el1t.ru/uploads/2020/01/27/7e9c9ebc13ec11e.pdfIn PDF document text
- http://vop.rentaprice.ru/uploads/2020/01/28/fb2306.pdfIn PDF document text
- http://1169certified.us/uploads/1/3/0/5/130551472/2867808.pdfIn PDF document text
- http://tammykjohnson.com/uploads/1/3/0/3/130313199/guxidiwebotoj.pdfIn PDF document text
- https://bivutogixabem.weebly.com/uploads/1/3/0/6/130604696/2605721.pdfIn PDF document text
- https://vuwizosub.weebly.com/uploads/1/3/0/2/130287238/xemivuwazo.pdfIn PDF document text
- http://urfacefix.com/uploads/1/3/0/5/130551063/130551063.html#hp+stream+touch+screenIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign:
gate2019iitm.online
8 samples
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001666.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1666 | 9116 bytes |
SHA-256: 08200ca528489d93ac832e9e97d2eee4327738152f16a30999f291728039e377 |
|||
font_01_sfnt_off0000baf7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBAF7 | 16396 bytes |
SHA-256: d12e1945699adc080c3e2f49a2c45ee9a70cbb178c18d882f92367fcd923f800 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.