MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM', with the primary domain being 'brokersue.com'. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of embedded URLs strongly suggest a phishing or malware distribution campaign. The document body, though partially corrupted, mentions 'Scholarship affidavit format pdf', indicating a lure to entice users to click the malicious links.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://brokersue.com/uploads/1/3/0/5/130539427/504f1fd.pdf
- http://www.1up-products.com/uploads/1/3/0/7/130738831/lanalofakoxaw_fudewanitatil_jetizolidot_zijilepuloz.pdf
- http://maralynhargrove.com/uploads/1/3/0/7/130739016/292661.pdf
- http://4prettyhome.com/uploads/1/3/0/4/130489898/5940106.pdf
- http://perspectivecp.net/uploads/1/3/0/7/130739971/dagusuf_zetexorixelore_vaxitiwo.pdf
- http://mollymagdalain.com/uploads/1/3/0/5/130588757/tafiwadabuj_xejeta_jenezojujo.pdf
- http://goldtrucks4sale4x4.com/uploads/1/3/0/8/130873942/8456692.pdf
- http://khaliafrazier.com/uploads/1/3/0/7/130738607/6603117.pdf
- http://www.debfosteractress.com/uploads/1/3/0/5/130540176/tezofego_murilotofiw.pdf
- http://vendingvet.com/uploads/1/3/0/6/130604445/2bf0ef00944.pdf
- http://www.bossiercityfoundationrepair.com/uploads/1/3/0/9/130969824/5521141.pdf
- http://christinacarnesphotography.com/uploads/1/3/0/5/130588902/zowomobowemifavukile.pdf
- http://northwestpetscanning.com/uploads/1/3/0/5/130589427/2370546.pdf
- http://nshslibrary.org/uploads/1/3/0/7/130739082/moxoxuziwebaw_mewusuxib.pdf
- http://vintagewoodworkingtools.net/uploads/1/3/0/7/130776185/dibivebalov.pdf
- http://allamericandoorny.com/uploads/1/3/0/5/130543020/vovazowarefisax.pdf
- http://naomiwhiteheadtraining.com/uploads/1/3/0/4/130488416/5b7a359eed1a07c.pdf
- http://lethbridgechristiancounselling.ca/uploads/1/3/0/3/130379743/nobogoziru.pdf
- http://ttmr8.org/uploads/1/3/0/6/130604689/jizapufug.pdf
- http://project-black.net/uploads/1/3/0/4/130488395/tabiwetutegugon.pdf
- http://planaustral.com/uploads/1/3/0/3/130379178/sowagudes.pdf
- http://host119.carmichaelnl.com/uploads/1/3/0/6/130639941/130639941.html#scholarship+affidavit+format+pdf
- http://brokersue.com/u
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003ed8.bin7df88723569d4193f530fe437fb919d713328a77de93ba1b94bee14e62ba1f6b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3ED8 | 1712 bytes |
font_01_sfnt_off0000493d.bin37890faa1ec7dddd4aee085396893b778c0c489b71d95ee2fc509b8c05a85bcd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x493D | 7536 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.