MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded links, with the primary one pointing to 'acehomecareservicewherewe.com'. This heuristic, combined with ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', strongly suggests a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'Spoken english guru daily use sentences book', likely a lure. No scripts were extracted, limiting the analysis of direct payload execution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9987
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://acehomecareservicewherewe.com/uploads/1/3/0/2/130291463/jimezagudagiriw.pdf In PDF document text
- https://gebiraferoti.weebly.com/uploads/1/3/0/5/130552053/nobito.pdfIn PDF document text
- http://momentswithmadds.org/uploads/1/3/0/4/130483767/danubagovuli-dezisabar.pdfIn PDF document text
- http://saharaexchange.com/uploads/1/3/0/6/130604363/puzerab.pdfIn PDF document text
- http://ofoptical.com/uploads/1/3/0/4/130475918/fazabimopin_bisonavevojosaz_vowan_berufevixo.pdfIn PDF document text
- http://brightbuzz.biz/uploads/1/3/0/2/130289327/nutogep.pdfIn PDF document text
- http://mermaidicamusic.com/uploads/1/3/0/7/130775630/tokezurenoraru.pdfIn PDF document text
- http://message6666.com/uploads/1/3/0/5/130588410/84d6faebb.pdfIn PDF document text
- http://obpassociation.com/uploads/1/3/0/5/130551058/2763219.pdfIn PDF document text
- http://stacyinexile.com/uploads/1/3/0/7/130775049/2830187.pdfIn PDF document text
- http://michaudwellness.com/uploads/1/3/0/7/130775935/130775935.html#spoken+english+guru+daily+use+sentences+bookIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001246.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1246 | 7908 bytes |
SHA-256: 65914d3d804003f6d9b01bb0e0730a4b6885b4ad3530376c000681219069d982 |
|||
font_01_sfnt_off0000492e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x492E | 16164 bytes |
SHA-256: 32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56 |
|||
font_02_sfnt_off00005df3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5DF3 | 1388 bytes |
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0 |
|||
font_03_sfnt_off000066a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x66A9 | 11336 bytes |
SHA-256: c17cdfc09978a85e1592131dddab52f9e9fbf02aab0e0a2296c2a4c141c246b8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.