MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The primary URL identified is http://postalmx.com/uploads/1/3/0/2/130272361/gozuxuledilizekuf.pdf, which is part of a link farm designed to direct users to potentially malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://postalmx.com/uploads/1/3/0/2/130272361/gozuxuledilizekuf.pdf In PDF document text
- http://sc45.weebly.com/uploads/1/3/0/4/130475901/779556.pdfIn PDF document text
- http://dlrichiepainting.com/uploads/1/3/0/4/130488157/perubokam.pdfIn PDF document text
- https://womejaritidawo.weebly.com/uploads/1/3/0/4/130436018/75c9893e1df4f.pdfIn PDF document text
- http://andrespardor.com/uploads/1/3/0/5/130539247/8433273.pdfIn PDF document text
- http://newmomcompany.com/uploads/1/3/0/6/130604388/masas.pdfIn PDF document text
- http://3dactivesports.com/uploads/1/3/0/4/130483270/nezopuxaw.pdfIn PDF document text
- http://hospitalitytechsummit.ie/uploads/1/3/0/2/130288962/6111955.pdfIn PDF document text
- http://newtrailpioneer.com/uploads/1/3/0/5/130590339/6146801.pdfIn PDF document text
- http://mrsroperlsga.weebly.com/uploads/1/3/0/2/130272361/7331fc1f86b66d0.pdfIn PDF document text
- http://youngatheartdesigns.com/uploads/1/3/0/3/130379462/solirogapafan.pdfIn PDF document text
- http://memijo.sell-video.ru/uploads/2020/01/28/5242937.pdfIn PDF document text
- http://pcaregionalconference2019.com/uploads/1/3/0/4/130436196/vepoxutedaginer_jinosotidusel.pdfIn PDF document text
- http://loweslake.com/uploads/1/3/0/6/130621973/7749f73d.pdfIn PDF document text
- http://foren.bootsalebonanza.com/uploads/2020/01/28/ramimudomuras_politoputane.pdfIn PDF document text
- http://alyssacoughenour.com/uploads/1/3/0/6/130639377/dapovojumuj-zimezaxor-wawaw.pdfIn PDF document text
- https://kamowexu.weebly.com/uploads/1/3/0/2/130289530/wativolexusinu.pdfIn PDF document text
- http://nutritioncapecod.com/uploads/1/3/0/6/130640022/sepigolijuximibunuxu.pdfIn PDF document text
- http://slaughterhouseadventure.com/uploads/1/3/0/3/130313272/3656238.pdfIn PDF document text
- http://teamjaime.com/uploads/1/3/0/5/130551832/c143be0c8e2248.pdfIn PDF document text
- http://artm.agency/uploads/1/3/0/5/130540664/zusetalemav_jewofuda_pitato_notewilibisiz.pdfIn PDF document text
- http://xefazap.kunnor.xyz/uploads/2020/01/29/502525.pdfIn PDF document text
- http://mountain-ammo.com/uploads/1/3/0/2/130289765/ad0585127c5.pdfIn PDF document text
- http://5pointauto.com/uploads/1/3/0/2/130289625/130289625.html#exercices+d%27+orthographe+ce1+pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001774.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1774 | 9260 bytes |
SHA-256: b6017d4dd6cbe26eb01165f13e426fcdc6dd02b147be6eb433654451f1ca2aae |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.