MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file contains a large number of external links, many of which point to other PDF files, indicating a link farm for SEO purposes. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' suggests a phishing or traffic redirection scheme. The embedded URLs are likely part of this redirection, aiming to lead users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://unitedstatesyearbooks.com/uploads/1/3/0/3/130323555/tepiwavizif.pdf In PDF document text
- http://mb-spot.com/uploads/1/3/0/4/130483653/mumofamekuji-pasafus-wunokukiziduze.pdfIn PDF document text
- http://alohabrewed.com/uploads/1/3/0/5/130550833/tirudozora.pdfIn PDF document text
- http://flipur.com/uploads/1/3/0/6/130639442/78ce368fea8.pdfIn PDF document text
- http://wpdogs.com/uploads/1/3/0/3/130379179/397f4cd.pdfIn PDF document text
- http://forloveandjustice.com/uploads/1/3/0/3/130313504/vubotemaz.pdfIn PDF document text
- http://bryhern.com/uploads/1/3/0/2/130288318/lakewirifosasap-fiwafidadod.pdfIn PDF document text
- http://solarsuddzllc.com/uploads/1/3/0/4/130483487/3872917.pdfIn PDF document text
- http://torndowncircus.com/uploads/1/3/0/7/130776558/neverejexubowo.pdfIn PDF document text
- http://yourpracticemultiplier.net/uploads/1/3/0/4/130483650/149114.pdfIn PDF document text
- http://liveloveindigo.com/uploads/1/3/0/8/130873841/113babadb8206.pdfIn PDF document text
- http://shadowhorseprodcutionsllc.com/uploads/1/3/0/5/130590588/514f179de0.pdfIn PDF document text
- http://pringleswrap.com/uploads/1/3/0/6/130620370/karivizowofab-jefuvi-dabanona-xonidawagate.pdfIn PDF document text
- http://lasvegasreservestudy.com/uploads/1/3/0/6/130639872/zonax.pdfIn PDF document text
- http://mhsbooster.bluewireweb.com/uploads/1/3/0/3/130323421/c7ef0cb1.pdfIn PDF document text
- http://cherry-cherie-creations.com/uploads/1/3/0/2/130289247/gonipetinonatox.pdfIn PDF document text
- http://baffen35.com/uploads/1/3/0/2/130272250/2952094.pdfIn PDF document text
- http://yourstoryof.com/uploads/1/3/0/6/130604772/junamanewelu-xugeviw.pdfIn PDF document text
- http://jakeneuman.net/uploads/1/3/0/5/130539108/balefus_raxipiru.pdfIn PDF document text
- http://floydfx.com/uploads/1/3/0/4/130436339/boneti.pdfIn PDF document text
- http://stuarttodduk.com/uploads/1/3/0/2/130289387/gifolazadipoxiwapep.pdfIn PDF document text
- http://suejardin.studio/uploads/1/3/0/7/130776104/ziruv.pdfIn PDF document text
- http://bubbcomics.com/uploads/1/3/0/4/130476491/labigafevanufoso.pdfIn PDF document text
- http://bangkokrepublik.co/uploads/1/3/0/6/130640198/jadoxozobele_govusebub_totilekodajijik.pdfIn PDF document text
- http://biyingkeshishicaizhucema.br3h.com/uploads/1/3/0/3/130312972/130312972.html#american+gods+neil+gaiman+pdf+espa%C3%B1olIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004e0b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E0B | 10252 bytes |
SHA-256: fe199287ca87f325754d122afe9706e80b7cc45b7f257a53d1ddab3b73ac5cc8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.