MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics, including a critical rule indicating a mass external PDF link farm. The embedded URLs suggest a tactic to redirect users to a large number of other PDF documents, likely for SEO manipulation or to host malicious content. The ML classifier also strongly indicated maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ldsstrangite.org/uploads/1/3/0/5/130539016/raxobidow-laxub-wegivivod-kusakebanajut.pdf
- http://mypups4u.com/uploads/1/3/0/2/130271078/8cc2edff9.pdf
- http://zeg.coachesportivo.com/uploads/2020/01/27/koxav_gawogigopevi_fopajujufulema_sujex.pdf
- https://kuguludoguwagi.weebly.com/uploads/1/3/0/2/130289478/jaxelorupulowudefuwa.pdf
- http://euvat.solutions/uploads/1/3/0/6/130639493/nerubok.pdf
- http://veb.icgauthbanquepoportail.com/uploads/2020/01/29/rixapeke.pdf
- http://ninefortyfilms.com/uploads/1/3/0/5/130543262/perufipapino_puzekadafu_lujovomag_vaputafukat.pdf
- http://cookingwithpolygons.com/uploads/1/3/0/5/130551941/1799981.pdf
- http://jet.secondlives.biz/uploads/2020/01/28/e43312e.pdf
- http://artispira.com/uploads/1/3/0/5/130543106/1f9cff5c6369a8.pdf
- http://gaz-shop.com/uploads/2020/01/29/4327744.pdf
- http://rateyouthsports.com/uploads/1/3/0/6/130621677/refux.pdf
- http://niwiniri.optomsahar.ru/uploads/2020/01/27/mowuwusex-xemuzonug-guxut.pdf
- http://aaadentalbahamas.com/uploads/1/3/0/4/130489066/vamofufa-bijemuxekepu-bolakobo.pdf
- http://adriantobin.com/uploads/1/3/0/3/130379163/xixoj-mevijudu.pdf
- http://bubemeviku.seubluray.com/uploads/2020/01/27/0cafff.pdf
- http://sunburstmusic.org/uploads/1/3/0/4/130435738/wokowazewalufujite.pdf
- http://prettylittlethings.ca/uploads/1/3/0/4/130476678/nofefaxikuworetexu.pdf
- http://automaticpocketdoor.com/uploads/1/3/0/6/130639251/8299503.pdf
- http://spatzen.hu/uploads/1/3/0/5/130589165/jezudomojur-potas.pdf
- http://tosobe.prorealgames.com/uploads/2020/01/28/jimuperog.pdf
- http://theelfbox.com/uploads/1/3/0/4/130476079/130476079.html#cooch+behar+weather+report
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001948.bin8deea64082ff93b68c09d95949f8dd39ac4e609e508ecde78e0cb5c1b9a53996 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1948 | 11200 bytes |
font_01_sfnt_off00006b94.bine91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B94 | 2652 bytes |
font_02_sfnt_off00007487.bincbe7a62b69fdb922f8f163d67e74915eaff952d21b2fe13d67c0a71899693a57 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7487 | 16452 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.