MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a coordinated effort to distribute malicious content or manipulate search engine results. The ClamAV detection further confirms the malicious nature of the file, classifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://aisdcoatdrive.org/uploads/1/3/0/5/130551556/050627711404.pdf In PDF document text
- http://mediclear.net/uploads/1/3/0/8/130874115/987746.pdfIn PDF document text
- http://vjohnsonperceptionsllc.com/uploads/1/3/0/4/130435667/balomerela.pdfIn PDF document text
- http://delarosacreations.net/uploads/1/3/0/4/130490451/zisimuliliwuda_benudoxitef.pdfIn PDF document text
- http://newyorksocialpages.com/uploads/1/3/0/3/130323341/vanesuliluvurikazup.pdfIn PDF document text
- http://host174.aesco.com/uploads/1/3/0/5/130551188/guneselalufoganuxi.pdfIn PDF document text
- http://myidahoinsure.com/uploads/1/3/0/6/130620847/185181.pdfIn PDF document text
- http://motivationalfactor.com/uploads/1/3/0/3/130379740/kumeneju-bedub-xotoraxadiwivo.pdfIn PDF document text
- http://kevinadventures.com/uploads/1/3/0/7/130776233/4451162.pdfIn PDF document text
- http://fosteringthefearless.com/uploads/1/3/0/5/130541133/nasowoz.pdfIn PDF document text
- http://hostmaster.surgicaltrainingnetwork.org/uploads/1/3/0/5/130589083/8608433.pdfIn PDF document text
- http://marriedinmaine.net/uploads/1/3/0/5/130545684/3307127.pdfIn PDF document text
- http://littlehouseonthegrid.net/uploads/1/3/0/6/130620364/malakawes.pdfIn PDF document text
- http://jcsqualityservices.com/uploads/1/3/0/8/130873863/vamujuwapulezufobuw.pdfIn PDF document text
- http://hokuainvestments.com/uploads/1/3/0/6/130605306/dawope.pdfIn PDF document text
- http://www.mystudio500-woodfiredpottery.com/uploads/1/3/0/5/130543310/dexalil.pdfIn PDF document text
- http://lloydstreeter.com/uploads/1/3/0/5/130539728/c898df505457946.pdfIn PDF document text
- http://www.rydalmerefc.com/uploads/1/3/0/4/130436367/126851.pdfIn PDF document text
- http://krutimodekurty2017.com/uploads/1/3/0/2/130270777/5691695.pdfIn PDF document text
- http://74-123-79-182.mgwnet.com/uploads/1/3/0/2/130289779/130289779.html#travelling+salesman+problem+c+++codeIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002d34.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2D34 | 8292 bytes |
SHA-256: ca4a2789bbb00c69d699956c0ded6b25d7533445e68f7d81e8608c5904354934 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.