MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' indicates the document contains a large number of external links, specifically pointing to other PDF files hosted on various domains. The document body, though partially corrupted, contains text related to an exam answer key, suggesting a lure to trick users into downloading further malicious content. The primary attack pattern involves a link farm designed to distribute malicious PDF files.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bcmediaphotographydesign.weebly.com/uploads/1/3/0/3/130324119/vinupuni.pdf
- http://nowandzenpet.com/uploads/1/3/0/2/130289352/4421859.pdf
- http://ncjoyofgarlic.com/uploads/1/3/0/5/130589094/tikus-jigivolik-gelamejipobuzeg.pdf
- http://zag.xs-motors.pro/uploads/2020/01/27/kebuxifupotuzub.pdf
- http://limestonepantry.ca/uploads/1/3/0/2/130291471/f60c23fbc7f.pdf
- http://diamondbabygems.com/uploads/1/3/0/4/130488195/9496410.pdf
- http://advanceproductservices.com/uploads/1/3/0/5/130588895/xebefabevo-gadinanutawevo-dobemokubugen-sisekufenina.pdf
- http://theheroinesclub.com/uploads/1/3/0/6/130604945/1289225.pdf
- http://kbkornhole.com/uploads/1/3/0/3/130313459/4296726.pdf
- http://woj.ants-life.ru/uploads/2020/01/28/2381494.pdf
- http://danilorojasmendez.tech/uploads/2020/01/28/32ab9e6d.pdf
- http://bewear2kxtensions.org/uploads/1/3/0/5/130590716/mefez.pdf
- http://myrolemodel.info/uploads/1/3/0/6/130604040/komebelawajire.pdf
- http://daveict.com/uploads/1/3/0/5/130550846/kafetefelagelevar.pdf
- http://borado.healthmonitoring.tech/uploads/2020/01/28/5640186.pdf
- http://knoxvilleangels.org/uploads/1/3/0/3/130313161/2425070.pdf
- http://atozadventures.co.uk/uploads/1/3/0/5/130544539/8596524.pdf
- http://support-account.net/uploads/2020/01/29/sinilaxunad.pdf
- http://wakeforestfarmersmarket.com/uploads/1/3/0/5/130540525/7681442.pdf
- http://bakidep.ekzolocin-ot-gribka.pro/uploads/2020/01/28/wepesogupo.pdf
- http://nanba-ryu.com/uploads/1/3/0/5/130546333/1992178.pdf
- http://seditivu.ssberprizee.info/uploads/2020/01/27/wetozo_dugubibowela.pdf
- http://pabuzufeko.caverna.info/uploads/2020/01/28/2685562.pdf
- http://myracare.de/uploads/1/3/0/5/130588531/8241220.pdf
- http://mysaddlefitter.net/uploads/1/3/0/5/130588799/130588799.html#cdpo+exam+maharashtra+2018+answer+key
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001736.bin28dac4f17948dcf34abca2e5a96ca0ee01f7163b3fabcbfe9078ca7c21da9a95 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1736 | 8088 bytes |
font_01_sfnt_off000071a7.bin5aca586b07654f11433de7be2811397b52dd92532cb7c16a4f4a24776a986792 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x71A7 | 8336 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.