MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically identifying it as a phishing or traffic-robot-related PDF. The embedded URLs likely lead to further malicious content or SEO spam pages.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://newtampatraillife.com/uploads/1/3/0/6/130620363/sekuter_kaferaxuzazu_vataxini_lanajez.pdf In PDF document text
- http://www.msptohumboldtproducts.com/uploads/1/3/0/7/130775624/relir_wajebosotesaj_veribavaluxafax.pdfIn PDF document text
- http://global4xloan.com/uploads/1/3/0/2/130287463/fesus-mowedadegani-kofiwatexidavod-kuwopenobib.pdfIn PDF document text
- http://murraywhiteley.com/uploads/1/3/0/9/130969080/5766907.pdfIn PDF document text
- http://swintuitiveart.com/uploads/1/3/0/4/130484005/b66c6076c1e5.pdfIn PDF document text
- http://thetexasplug.com/uploads/1/3/0/3/130379146/02c72f.pdfIn PDF document text
- http://christianambulancenetwork.com/uploads/1/3/0/4/130478110/2602651.pdfIn PDF document text
- http://changeyourquestionschangeyourlife.com/uploads/1/3/0/5/130589035/tufakiwedawudug-rudozudidaso-tagebunoretafa.pdfIn PDF document text
- http://ducksnestdecoys.com/uploads/1/3/0/4/130435787/moxizexe.pdfIn PDF document text
- http://targetlc.com/uploads/1/3/0/3/130313114/novub.pdfIn PDF document text
- http://moderndayman.org/uploads/1/3/0/4/130488338/mulojonejukibun_buwuminiwi_viremixib.pdfIn PDF document text
- http://1n5th.com/uploads/1/3/0/5/130540714/2071039.pdfIn PDF document text
- http://missionepossibilehk.com/uploads/1/3/0/6/130620576/2945841.pdfIn PDF document text
- http://acgr.info/uploads/1/3/0/7/130775522/gezuvexibig.pdfIn PDF document text
- http://cardiffhomedesign.com/uploads/1/3/0/7/130739129/sugeweluk-lukalokagip.pdfIn PDF document text
- http://pixelpush.net/uploads/1/3/0/7/130776492/litopivawomitisafabu.pdfIn PDF document text
- http://whateverwelding.com/uploads/1/3/0/7/130740368/gofapebamipine_lejimazo_xuwolisukuk.pdfIn PDF document text
- http://hostmaster.deemaciephotography.co.uk/uploads/1/3/0/3/130313265/fubejaweti-ragen.pdfIn PDF document text
- http://kellyskreative.com/uploads/1/3/0/8/130874021/6655176.pdfIn PDF document text
- http://inhealthcarerealestate.com/uploads/1/3/0/4/130488451/c686c7841.pdfIn PDF document text
- http://www.designerin-sucht-technikjob.de/uploads/1/3/0/4/130435757/130435757.html#in+gamete+intrafallopian+transfer+%28gift%29+fertilization+occurs+in+quizletIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000012c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12C1 | 8308 bytes |
SHA-256: 3428a5affcc1eb9d35fe96dffcea93ffc9708f38d03549c4fdf24c33f8261590 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.