MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier strongly indicate maliciousness, with the ClamAV signature suggesting a phishing or robot installation attempt. The embedded links likely serve to redirect users to malicious sites or for SEO spamming purposes.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://motwh.org/uploads/1/3/0/6/130603737/51079.pdf In PDF document text
- http://kupcar.com/uploads/1/3/0/7/130739850/b6b58e0.pdfIn PDF document text
- http://myweeklyonline.com/uploads/1/3/0/6/130640239/boxepamo.pdfIn PDF document text
- http://unidosporlaprofesion.com.ar/uploads/1/3/0/7/130776101/bifizifiderura.pdfIn PDF document text
- http://3828riverroadbricknj.com/uploads/1/3/0/3/130323342/wigizixofur.pdfIn PDF document text
- http://kyledropp.com/uploads/1/3/0/4/130483492/pipubifad-bamowolazi-refapifomev-mofapavufiwob.pdfIn PDF document text
- http://nwrealtybrokers.com/uploads/1/3/0/6/130640231/4801120.pdfIn PDF document text
- http://sonicaarora.com/uploads/1/3/0/6/130621163/afec5d3.pdfIn PDF document text
- http://newearth.design/uploads/1/3/0/4/130476791/pusevujefej.pdfIn PDF document text
- http://cclmobile.org/uploads/1/3/0/5/130590168/8d1b3a51a82b.pdfIn PDF document text
- http://app.surveyswipe.com/uploads/1/3/0/6/130620979/6097c4ab8d41.pdfIn PDF document text
- http://www.hiddenbeautyofedwinstowe.com/uploads/1/3/0/6/130621060/7440154.pdfIn PDF document text
- http://navslaborers.org/uploads/1/3/0/4/130483924/3716553.pdfIn PDF document text
- http://avadhaniestate.net/uploads/1/3/0/3/130313359/xifonururoxowutog.pdfIn PDF document text
- http://couragedude.com/uploads/1/3/0/2/130289767/14773.pdfIn PDF document text
- http://purebark.com/uploads/1/3/0/6/130620970/27ebcd31.pdfIn PDF document text
- http://alleylouisville.com/uploads/1/3/0/6/130605174/338d5ec74168d4.pdfIn PDF document text
- http://webmail.smoochsoaps.com/uploads/1/3/0/3/130313428/6e7b141e01ee3.pdfIn PDF document text
- http://wiowigo.com/uploads/1/3/0/3/130323601/mebowitoviwusi_gopomazabekexo.pdfIn PDF document text
- http://nogenetix.com/uploads/1/3/0/5/130543035/3f2e9d0697cacd8.pdfIn PDF document text
- http://bikramyogaoswego.com/uploads/1/3/0/7/130776787/dazur.pdfIn PDF document text
- http://chrislockett.com/uploads/1/3/0/6/130640013/sifabikewofam.pdfIn PDF document text
- http://zuihaowanqipaiyouxi.br3h.com/uploads/1/3/0/8/130813866/130813866.html#profit+and+loss+account+balance+sheet+formatIn PDF document text
🗂 Part of campaign:
avadhaniestate.net
3 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000038a6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x38A6 | 7996 bytes |
SHA-256: 6ebe937fdd8e7b51615c35a0ff802533c2a61e11eaea237b08ececcb48c1f247 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.