MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing or traffic-robot related PDF. The embedded document body text appears to be corrupted or truncated, providing no clear user-facing lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://cayoconsulting.org/uploads/1/3/0/3/130379590/f5a0b6ba6ce1.pdf In PDF document text
- http://ns2.mitasbakeshop.com/uploads/1/3/0/4/130476703/487b1fde1.pdfIn PDF document text
- http://strawhatgames.com/uploads/1/3/0/5/130589354/b3ec0f4604f.pdfIn PDF document text
- http://www.jackmcmahonfilm.com/uploads/1/3/0/4/130489465/ninekifijajugawobot.pdfIn PDF document text
- http://www.babybuddies.us/uploads/1/3/0/2/130272420/bafanuzaj-giperepa.pdfIn PDF document text
- http://vergisdigitalmarketing.com/uploads/1/3/0/6/130639267/bijuzumavepo.pdfIn PDF document text
- http://supertekamerica.com/uploads/1/3/0/6/130639845/fisawepikafakogana.pdfIn PDF document text
- http://oest.juniortalent.dk/uploads/1/3/0/7/130739204/lanop-zawexog-tozekasir-werelamozo.pdfIn PDF document text
- http://helpsy.com/uploads/1/3/0/5/130544072/ratunavogiso_welivi.pdfIn PDF document text
- http://noon2moon.com/uploads/1/3/0/6/130620906/nugetawe.pdfIn PDF document text
- http://raisin-and-raspberry-boutique.com/uploads/1/3/0/7/130739654/sozojowekoxobemejad.pdfIn PDF document text
- http://mail.newsgproperty.com/uploads/1/3/0/7/130740598/vedikedugox_bebume.pdfIn PDF document text
- http://summitssinc.com/uploads/1/3/0/5/130541600/nugilupenevalu_jarabududij_vilokade_xasubazanipexo.pdfIn PDF document text
- http://thunderbirdsprings.com/uploads/1/3/0/8/130814559/kagowe-revokuwulemin-mexap-gasojajuvovawun.pdfIn PDF document text
- http://www.tejassteelworks.com/uploads/1/3/0/5/130590677/vazilugep.pdfIn PDF document text
- http://mikedonovancoronado.com/uploads/1/3/0/6/130620320/8557797.pdfIn PDF document text
- http://robertsenterprisesllc.com/uploads/1/3/0/3/130379341/bubezonul.pdfIn PDF document text
- http://yinghuangguojixinyuhao.br3h.com/uploads/1/3/0/5/130590278/130590278.html#tp-link+archer+c20i+ac750+wireless+dual+band+routerIn PDF document text
- http://www.adobe.com/).NotoIn PDF document text
- http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
- http://scripts.sil.org/OFLNotoIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002ea9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2EA9 | 4360 bytes |
SHA-256: 3b2441b63b4f20bbc0606f1c2771d4fa72eb82cfef75297c7870c685f3836417 |
|||
font_01_sfnt_off00003f0b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3F0B | 8364 bytes |
SHA-256: 881965b248b5774f7fa7799d119c6c8d8c839bd08607c9e7f580f2c8459075ca |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.