MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF was flagged by multiple heuristics, including a critical finding for a large external link farm and a ClamAV detection for phishing. The embedded URLs likely lead to malicious content or phishing sites. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://marioscleaningservice.com/uploads/1/3/0/7/130740110/witatiwe_funal_maritufopolarow.pdf In PDF document text
- http://www.boogiecamp.com/uploads/1/3/0/4/130488362/roveruxiroxubofilex.pdfIn PDF document text
- http://a7.denjac.com/uploads/1/3/0/7/130739945/vebomeguvi_venudu_jifitoromawo.pdfIn PDF document text
- http://mjjam.net/uploads/1/3/0/3/130313103/vevaxiboromoti.pdfIn PDF document text
- http://kyoto-japan-django.club/uploads/1/3/0/7/130739028/42baca1.pdfIn PDF document text
- http://www.rachelandedwedding.com/uploads/1/3/0/9/130969853/0eca139d45614fd.pdfIn PDF document text
- http://kungfu-silat.net/uploads/1/3/0/7/130775651/kewugo.pdfIn PDF document text
- http://geigerair.com/uploads/1/3/0/5/130550960/d8a194b04c83.pdfIn PDF document text
- http://nrgsupply.ie/uploads/1/3/0/2/130291373/komigesikit-zodofuxexu-vokagafafomu.pdfIn PDF document text
- http://eraji.net/uploads/1/3/0/2/130274345/wonibuxunu-zodulotamugi-tuwox.pdfIn PDF document text
- http://bluepointassetmanagement.com/uploads/1/3/0/8/130814078/dewawamokube.pdfIn PDF document text
- http://www.ksamconsulting.com/uploads/1/3/0/7/130776351/tivozizub-godanatif.pdfIn PDF document text
- http://secondaire1et2.net/uploads/1/3/0/4/130489926/kotiz.pdfIn PDF document text
- http://buyeveryinglobal.com/uploads/1/3/0/2/130288381/babasu_kanuwer.pdfIn PDF document text
- http://shemikamoore.com/uploads/1/3/0/6/130603989/56f77932ff127ba.pdfIn PDF document text
- http://jamiefehr.com/uploads/1/3/0/6/130640199/130640199.html#h%C6%B0%E1%BB%9Bng+d%E1%BA%ABn+chuy%E1%BB%83n+file+pdf+sang+word+2013In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000631d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x631D | 2736 bytes |
SHA-256: 27aad4e7100ae85831cc1a9cf4859e84521ff6b1ee9ac199fa10e6c4d4b25dad |
|||
font_01_sfnt_off00006e08.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6E08 | 24860 bytes |
SHA-256: 944c796357a4ae6d7d210ced0f218a56d70dd4ea32916f01a89b67ac36eebc58 |
|||
font_02_sfnt_off0000906b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x906B | 10812 bytes |
SHA-256: cb17844ec16c443efa24d9594fb73fffe2f69bbced93e28a46300ede460a504b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.