MALICIOUS
232
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also strongly flagged this PDF as malicious. The document body, though truncated, mentions 'Programa para juntar fotos em pdf', which could be a lure to disguise the malicious nature of the links.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 5
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bethrabin.com/uploads/1/3/0/6/130621387/fofegisebixa-maxoxapil-mikubabatuxadap.pdf In PDF document text
- http://www.irkvalleyhangout.com/uploads/1/3/0/6/130639093/3231235.pdfIn PDF document text
- http://consultoriaconsciente.com/uploads/1/3/0/4/130491319/mefoli.pdfIn PDF document text
- http://jlc.press/uploads/1/3/0/3/130313218/5189280.pdfIn PDF document text
- http://athenahighlibrary.com/uploads/1/3/0/5/130589315/wusasapodezufup.pdfIn PDF document text
- http://go15forum.com/uploads/1/3/0/2/130272291/6059224.pdfIn PDF document text
- http://325986690869568534.com/uploads/1/3/0/2/130287548/6436737.pdfIn PDF document text
- http://amckbc.com/uploads/1/3/0/2/130287882/604413.pdfIn PDF document text
- http://paintings.marycatherinestarr.com/uploads/1/3/0/7/130775443/928218.pdfIn PDF document text
- http://desatascossantfeliudellobregat.com/uploads/1/3/0/6/130621390/veratanofenilaf.pdfIn PDF document text
- http://bhbwater.com/uploads/1/3/0/6/130622024/94e52f6274d.pdfIn PDF document text
- http://www.cannabisjobopenings.com/uploads/1/3/0/5/130550770/ba435b.pdfIn PDF document text
- http://triosdl.com/uploads/1/3/0/5/130588968/8319725.pdfIn PDF document text
- http://johnvthephotographer.online/uploads/1/3/0/6/130603756/bobunizunoj.pdfIn PDF document text
- http://timyang.com/uploads/1/3/0/7/130776611/lulifilidejutuserus.pdfIn PDF document text
- http://www.zacharyjonesre.com/uploads/1/3/0/7/130776698/gigubonoxotexarepoxu.pdfIn PDF document text
- http://hvo48.slpny.com/uploads/1/3/0/6/130622076/130622076.html#programa+para+juntar+fotos+em+pdfIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004afb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4AFB | 10008 bytes |
SHA-256: 22028a9c2202c16784975e784bad307392c21899ebaa9e0fdf9b0a3117da22d2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.