MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged by multiple heuristics, including ClamAV and a machine learning classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external PDF links, with the primary observed URL being http://ranujet.iddingwitsof.mobi/uploads/2020/01/28/vuvixukon-kanimavakumi-zazipiri-sefuvabis.pdf. This suggests the document's primary purpose is to act as a lure, redirecting users to potentially malicious content hosted on numerous domains.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ranujet.iddingwitsof.mobi/uploads/2020/01/28/vuvixukon-kanimavakumi-zazipiri-sefuvabis.pdf In PDF document text
- http://andreablackerby.com/uploads/1/3/0/6/130604045/fulezazizavesu.pdfIn PDF document text
- https://tunorumoge.weebly.com/uploads/1/3/0/4/130483909/fibomax.pdfIn PDF document text
- http://spencerhaggardindustrialdesign.com/uploads/1/3/0/2/130288720/tazobudodomogeruv.pdfIn PDF document text
- http://nicoleedwardslimited.com/uploads/1/3/0/4/130478760/kagegijawirabos-pekamolode-ledamesinivog-rogolulupezixa.pdfIn PDF document text
- http://lazylstudio.com/uploads/1/3/0/2/130289765/garisanerimedo_botemofalo_vezejenefesox_vizajenu.pdfIn PDF document text
- http://jun.finding-love.online/uploads/2020/01/29/ruvunevi.pdfIn PDF document text
- http://sisewe.instagame.biz/uploads/2020/01/28/2088381.pdfIn PDF document text
- http://wosoz.tele-zvon.ru/uploads/2020/01/28/96dedadc97.pdfIn PDF document text
- http://keldridge.com/uploads/1/3/0/2/130292098/lezirodusi.pdfIn PDF document text
- http://baz.fashionmoney.online/uploads/2020/01/28/d4d737f.pdfIn PDF document text
- http://relevantinnovations.global/uploads/1/3/0/3/130323547/6834230.pdfIn PDF document text
- http://misbailes.com/uploads/1/3/0/6/130639891/130639891.html#sports+tv+2.+0.+8+apkIn PDF document text
- http://linux.thai.net/projects/fonts-tlwgIn PDF document text
- http://www.thaitux.infoIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001399.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1399 | 7912 bytes |
SHA-256: 23af53c5e875beaab3df77bdc0c560c8aa2dffa0851a8198624bb5ae997ca871 |
|||
font_01_sfnt_off000053c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x53C2 | 10944 bytes |
SHA-256: ee737efe1ff7793f54631a61eda178506ac5e534475d7de4b281072c19a31296 |
|||
font_02_sfnt_off00006b6d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6B6D | 16092 bytes |
SHA-256: c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.