MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The primary attack pattern observed is a link farm, directing users to numerous external PDF files. The embedded URLs suggest a phishing or content distribution campaign, potentially for SEO manipulation or malware delivery. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://niralidevgan.com/uploads/1/3/0/2/130291783/8027c311b.pdf In PDF document text
- http://mew3mew.studio/uploads/1/3/0/5/130588220/3234188.pdfIn PDF document text
- http://rusibivuj.vipiski-besplatno19.icu/uploads/2020/01/28/3373995.pdfIn PDF document text
- http://radioevasi.com/uploads/1/3/0/6/130621809/4474218.pdfIn PDF document text
- http://midatlanticbowl.com/uploads/1/3/0/4/130483868/fakanego-bokufimanazudew.pdfIn PDF document text
- http://subordominant.com/uploads/1/3/0/4/130483981/5529757.pdfIn PDF document text
- http://thoughtjotsmemobooks.com/uploads/1/3/0/5/130590467/1398305.pdfIn PDF document text
- https://kukefokojuf.weebly.com/uploads/1/3/0/5/130590475/95002.pdfIn PDF document text
- http://midwesthomebuilding.com/uploads/1/3/0/6/130620478/b226045ba6c.pdfIn PDF document text
- http://fezosepig.roo1gai.ru/uploads/2020/01/29/57a085e.pdfIn PDF document text
- http://astarboards.com/uploads/1/3/0/3/130313191/ae925.pdfIn PDF document text
- http://postalmx.com/uploads/1/3/0/2/130270867/38606.pdfIn PDF document text
- http://automaticpocketdoor.com/uploads/1/3/0/4/130488544/55d090.pdfIn PDF document text
- http://wez.diba-konto.com/uploads/2020/01/28/fimufesekiko.pdfIn PDF document text
- http://vub.cafemostik.com/uploads/2020/01/28/6079943.pdfIn PDF document text
- http://livingmetroeast.com/uploads/1/3/0/6/130603930/jumowataj_gesenarib_kireroxuxuvo.pdfIn PDF document text
- http://mrncleaningservicescom.com/uploads/1/3/0/2/130291579/jiseno_fupegenoz_kilinumu.pdfIn PDF document text
- http://a-aon.com/uploads/1/3/0/6/130621412/6799301.pdfIn PDF document text
- http://aispng.org/uploads/1/3/0/3/130323184/b71f65b14e.pdfIn PDF document text
- http://mychampionlifechurch.com/uploads/1/3/0/2/130287527/sijir-bafipotof-zorofowore.pdfIn PDF document text
- http://pjclakes.com/uploads/1/3/0/5/130588656/da7ba0481.pdfIn PDF document text
- http://maggieakins.com/uploads/1/3/0/5/130550966/2f6a2015.pdfIn PDF document text
- http://nicolettabuildingcontractors.com/uploads/1/3/0/4/130435947/zubazelozifudekasomi.pdfIn PDF document text
- http://taxkill.com/uploads/1/3/0/3/130323674/zekarapapoloti.pdfIn PDF document text
- http://thesingbabysingshow.com/uploads/1/3/0/4/130489361/130489361.html#use+of+articles+in+english+grammar++worksheetIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000170f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x170F | 8064 bytes |
SHA-256: 06ca1411d7fe4a0c1c1016cabc7b58d0a94fa6a04d37e1802accdcf79bf2fdf7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.