MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links likely serve to distribute further malicious content or redirect users to phishing sites. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing or malware distribution campaign.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://leffet.fr/uploads/1/3/0/8/130813846/7ebbcbcd6992a49.pdf In PDF document text
- http://drgnzombiestournament.com/uploads/1/3/0/5/130551536/xavenif.pdfIn PDF document text
- http://branchettastreasures.com/uploads/1/3/0/7/130775195/jaxuri-jaxegexorise.pdfIn PDF document text
- http://misssupremepurityqueen.com/uploads/1/3/0/6/130640199/nulubobax-roronu.pdfIn PDF document text
- http://mydiabbyhc.com/uploads/1/3/0/5/130590371/xozob.pdfIn PDF document text
- http://www.looksbeautyandnails.nl/uploads/1/3/0/7/130776428/9d6fb.pdfIn PDF document text
- http://nsolc.com/uploads/1/3/0/5/130588256/674510.pdfIn PDF document text
- http://trentriverdesigns.com/uploads/1/3/0/2/130272481/8d46eb5c7c7.pdfIn PDF document text
- http://nomegasitehere.com/uploads/1/3/0/6/130604213/8171520.pdfIn PDF document text
- http://zo2yd.slpny.com/uploads/1/3/0/2/130272395/4fcde4f2dc7917.pdfIn PDF document text
- http://welcomeneighborftsmith.com/uploads/1/3/0/7/130740342/2af3fbf1.pdfIn PDF document text
- http://carbonneutralnetworks.com/uploads/1/3/0/7/130738732/jadubimo-ketazapejoz-nesuv-bojumagibivisaw.pdfIn PDF document text
- http://elysianresources.net/uploads/1/3/0/5/130588457/morerevebet.pdfIn PDF document text
- http://sacramentoyardcare.com/uploads/1/3/0/9/130969338/2b03be6c850993.pdfIn PDF document text
- http://555-jeudirouge.fr/uploads/1/3/0/5/130590395/3474205.pdfIn PDF document text
- http://mydmdesign.com/uploads/1/3/0/6/130603887/bijideraxezu.pdfIn PDF document text
- http://radio-pictures.com/uploads/1/3/0/6/130604723/xaxirufuto.pdfIn PDF document text
- http://geras.sk/uploads/1/3/0/2/130288444/novur-zokipunuruj-fididetozumopum.pdfIn PDF document text
- http://txa4d.com/uploads/1/3/0/8/130874179/mebowaladus-pifiba-molili.pdfIn PDF document text
- http://prosepia.com/uploads/1/3/0/5/130550833/130550833.html#gamepro+magazine+pdfIn PDF document text
🗂 Part of campaign:
aurasalontn.com
5 samples
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003f2c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3F2C | 7552 bytes |
SHA-256: c64d4d95afae35640df4a0d335f81b1b869e4587b2e3f5fff2bed4adc4d4e563 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.