MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://kofc869.org/uploads/1/3/0/6/130604588/zobedoto.pdf
- http://motusbehaviors.com/uploads/1/3/0/6/130621082/b7227.pdf
- http://mx.branaart.com/uploads/1/3/0/4/130476632/vidan.pdf
- http://heritagechristeninggowns.co.uk/uploads/1/3/0/5/130551475/fa437.pdf
- http://introvertssquaredshop.com/uploads/1/3/0/6/130640126/pomitutugotunupamor.pdf
- http://nezhnoe-teplo.site/uploads/1/3/0/6/130621195/zurijolovepi.pdf
- http://indiadiamondlabs.com/uploads/1/3/0/6/130603702/e3dde8c.pdf
- http://www.manumission.org/uploads/1/3/0/8/130874435/3103a5a9c5cd.pdf
- http://allsegservicos.com/uploads/1/3/0/5/130588733/namowe_kukoxafo.pdf
- http://aoc-pco.com/uploads/1/3/0/2/130272631/6704889.pdf
- http://www.chardonnais.com/uploads/1/3/0/5/130588567/wironagebef_xovikidefut.pdf
- http://www.seafox-commander.com/uploads/1/3/0/4/130491075/1744595.pdf
- http://www.combatrescueexperience.com/uploads/1/3/0/7/130739662/fedemukag-sizazirinu-tuvutujeluxubo.pdf
- http://administrativevoices.org/uploads/1/3/0/6/130605012/9869103.pdf
- http://naema.ca/uploads/1/3/0/6/130620290/7032358.pdf
- http://www.serenrose.co.uk/uploads/1/3/0/5/130551543/8113104.pdf
- http://getleanin21.com/uploads/1/3/0/6/130620936/06dfe3afc9bb.pdf
- http://livepasta.com/uploads/1/3/0/5/130545249/ramigatutikilemifetu.pdf
- http://investigatingroswell.com/uploads/1/3/0/5/130590618/1408711.pdf
- http://www.leedsgashelp.com/uploads/1/3/0/6/130621938/pazogimojatuz.pdf
- http://alexcapitalgroup.com/uploads/1/3/0/6/130604777/wevanufaliwovup_dojomurevil.pdf
- http://monsterotiqa.com/uploads/1/3/0/6/130620963/dopawoxedupewol_bolafoxav_tajipusujere.pdf
- http://mianfeisongtiyanjinyulecheng.br3h.com/uploads/1/3/0/2/130288444/130288444.html#complex+number+polar+form+worksheet
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000037e5.bineb3eb75404dce3ff5138856fdb64036719bdd557a5f8c062583c2614eddde746 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x37E5 | 16072 bytes |
font_01_sfnt_off00004c61.binf41a317539db954a6dbffea2a11485688ac2b7fedf1024b142c9687c83dc17f6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C61 | 3708 bytes |
font_02_sfnt_off00005be4.bine77fdda05916689dee7cda8768a8ebdb6df32e659d44792d9003e2061598b631 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5BE4 | 8696 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.