MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains, indicating a link farm or distribution network. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly suggest a malicious intent, likely related to phishing or SEO abuse. The document body, though partially corrupted, contains text related to PDF to Excel/CSV conversion, which could be a lure.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.annekevanderlende.nl/uploads/1/3/0/7/130776150/6c67aa4.pdf In PDF document text
- http://keepupwiththekeys.com/uploads/1/3/0/5/130539315/04342e71f8.pdfIn PDF document text
- http://www.trumpdeepstate.com/uploads/1/3/0/6/130604730/kowodadubipof.pdfIn PDF document text
- http://www.my-matthew-national-agency.com/uploads/1/3/0/5/130550983/25f2e92.pdfIn PDF document text
- http://hpcctimex.com/uploads/1/3/0/2/130291592/ronixovurel_davoxojiwuf_kezov.pdfIn PDF document text
- http://texasstocklawyers.com/uploads/1/3/0/3/130313484/pisipibolanezi-renuvoporafawer.pdfIn PDF document text
- http://portalfarmaceutico.net/uploads/1/3/0/3/130379821/373327.pdfIn PDF document text
- http://christopherleeauthor.com/uploads/1/3/0/5/130538987/2f2287.pdfIn PDF document text
- http://mydispatchers.com/uploads/1/3/0/4/130489039/9032664.pdfIn PDF document text
- http://med-impulse.ru/uploads/1/3/0/6/130604150/12a07d.pdfIn PDF document text
- http://waitakaruruschool.com/uploads/1/3/0/5/130548070/6332530.pdfIn PDF document text
- http://impulsandotusfinanzas.com/uploads/1/3/0/2/130289748/9861272.pdfIn PDF document text
- http://appea.com/uploads/1/3/0/5/130551294/musilotikupitebamu.pdfIn PDF document text
- http://sheldonxink.com/uploads/1/3/0/4/130436182/22187.pdfIn PDF document text
- http://kerrycrawford.com/uploads/1/3/0/7/130776828/2024394.pdfIn PDF document text
- http://northsidecigars.com/uploads/1/3/0/5/130543941/rejonerejesede.pdfIn PDF document text
- http://thegirlygabby.com/uploads/1/3/0/3/130379167/zodilureb_jokuw.pdfIn PDF document text
- http://cosmosit.net/uploads/1/3/0/6/130603690/fegumutogez_majovub.pdfIn PDF document text
- http://alumi68.info/uploads/1/3/0/6/130605203/5673312.pdfIn PDF document text
- http://www.midairconnect.net/uploads/1/3/0/5/130550834/11e9a30fb.pdfIn PDF document text
- http://duojonssoncoudroy.com/uploads/1/3/0/6/130605044/figaxosazagasos.pdfIn PDF document text
- http://pencilpenservices.com/uploads/1/3/0/3/130313453/130313453.html#convert+your+pdf+file+to+excel+or+csvIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003165.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3165 | 8216 bytes |
SHA-256: 6b318017eb1903830b83608d7bf10342fe6069a34d05d1190e57be6026388853 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.