MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent. The heuristic PDF_SEO_LINK_FARM specifically identifies the mass external link farm, with the first URL being http://simplyinspiredwords.com/uploads/1/3/0/5/130590019/9874288.pdf. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://simplyinspiredwords.com/uploads/1/3/0/5/130590019/9874288.pdf
- http://meditationdownloadfiles.com/uploads/1/3/0/8/130813518/02f8c9def.pdf
- http://www.daphneravey.com/uploads/1/3/0/7/130776895/lulobasutebojat.pdf
- http://my-spiritual-garden.net/uploads/1/3/0/5/130540897/lewovo-pikodudul-ridudebokekop.pdf
- http://beatrizgonzalezmusic.com/uploads/1/3/0/6/130639396/vigojog_gabiweguxugiko_milizesa_zunodi.pdf
- http://openrunstudios.com/uploads/1/3/0/7/130739558/b90f94593dd894.pdf
- http://www.dearherbook.com/uploads/1/3/0/7/130776693/244133.pdf
- http://wheretheriverfrowns.com/uploads/1/3/0/4/130436399/sonozete_zokanonaforuwe_novarivo_gafajejoxesogas.pdf
- http://ambienceflooringaustralia.com/uploads/1/3/0/7/130776821/156b6.pdf
- http://airdrivenmusic.club/uploads/1/3/0/5/130589216/soxazodox-webazatiko.pdf
- http://yasinrahim.com/uploads/1/3/0/6/130620454/1664478.pdf
- http://utwatch.org/uploads/1/3/0/6/130620576/173aeaa4bf4b20.pdf
- http://unidosporlaprofesion.com.ar/uploads/1/3/0/7/130775269/2274512.pdf
- http://mcpowercleanltd.com/uploads/1/3/0/4/130488811/robilex_rodizigulixiner_jurasaneweku_wulefumagudo.pdf
- http://rousemediaatl.com/uploads/1/3/0/8/130874676/lobakizavowow.pdf
- http://miko-trans.pl/uploads/1/3/0/5/130547613/palosaxive.pdf
- http://mypricelesspetals.com/uploads/1/3/0/3/130379415/8101912.pdf
- http://nbptweddingplanner.com/uploads/1/3/0/6/130605442/043bca91155a4f7.pdf
- http://74-123-72-164.mgwnet.com/uploads/1/3/0/5/130590261/fediluzenik.pdf
- http://kristawassenaar.com/uploads/1/3/0/2/130289019/2860724.pdf
- http://summervillepsych.com/uploads/1/3/0/4/130483351/2678419.pdf
- http://bestestcasinos.com/uploads/1/3/0/5/130589399/nijolibevow.pdf
- http://auntkates.com/uploads/1/3/0/5/130551523/d018c.pdf
- http://thegenerousgig-makingmusicforacause.com/uploads/1/3/0/5/130539235/xonokikubuxemowedita.pdf
- http://danecompany.com/uploads/1/3/0/6/130621292/188641a.pdf
- http://seizediem.com/uploads/1/3/0/8/130813079/130813079.html#practice+reading+passages+for+5th+grade
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000474f.bin8f9b1c574e9eb49ec9dbeb0916f966e85ae9b1ad5d058758274f3f4997df184b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x474F | 8344 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.