MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a significant number of embedded external links, characteristic of a link farm. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms this, indicating the document's purpose is to direct users to numerous other PDF files hosted across various domains. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://blackpowerchronicles.com/uploads/1/3/0/4/130489933/e56d671ec592a2.pdf In PDF document text
- http://redeeminghope.net/uploads/1/3/0/5/130588232/646b5ff064e6.pdfIn PDF document text
- http://brooksindustries13.com/uploads/1/3/0/8/130813957/034897c.pdfIn PDF document text
- http://www.lhvbresources.com/uploads/1/3/0/7/130739528/kagubedabev.pdfIn PDF document text
- http://kaffeeblack.biz/uploads/1/3/0/2/130288661/4341226.pdfIn PDF document text
- http://mail.r3fine.com/uploads/1/3/0/3/130379465/dadosofow.pdfIn PDF document text
- http://alexandriasday.com/uploads/1/3/0/4/130476078/vagikasetiroteduv.pdfIn PDF document text
- http://mommyandbeeboutique.com/uploads/1/3/0/5/130550855/guribudagosanu_napixavunuvima.pdfIn PDF document text
- http://emirefendic.com/uploads/1/3/0/4/130435672/wulotukexijesu_jupimiv.pdfIn PDF document text
- http://www.sonoraprojects.com/uploads/1/3/0/6/130603860/27df7dd.pdfIn PDF document text
- http://www.simonbrightsalon.com/uploads/1/3/0/3/130323381/duvate-tetofororutila-rofux.pdfIn PDF document text
- http://alliesonthejourney.com/uploads/1/3/0/2/130273814/fivora.pdfIn PDF document text
- http://rockthecatspa.us/uploads/1/3/0/7/130775257/8276978.pdfIn PDF document text
- http://sta-66-99-58-221.ladse.org/uploads/1/3/0/6/130640105/130640105.html#lm555+national+datasheetIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://www.adobe.com/).NotoIn PDF document text
- http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
- http://scripts.sil.org/OFLNotoIn PDF document text
🗂 Part of campaign:
excelappdevelopment.com
12 samples
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001da8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1DA8 | 16384 bytes |
SHA-256: 76d0edce5bdb93a691a0309c49e7369480f5d97eef5486ab960fc16df6d92a06 |
|||
font_01_sfnt_off0000332d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x332D | 5532 bytes |
SHA-256: c9f2766864d727e1393aa645f689f1e349cca9ca80d00af93de57b1bbf7dc8a8 |
|||
font_02_sfnt_off00004754.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4754 | 8964 bytes |
SHA-256: 14322085f51256465881bd7889e87cdecde454110ded3aa37689a7cb9361d2f0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.