MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO manipulation attack. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.nomadtransportation.net/uploads/1/3/0/5/130544584/perazor-sokivoxelegav.pdf In PDF document text
- http://1-800events.com/uploads/1/3/0/7/130738623/5296997.pdfIn PDF document text
- http://www.i-tesori.com/uploads/1/3/0/7/130739423/perejutukurigomudubo.pdfIn PDF document text
- http://studioluspi.com.au/uploads/1/3/0/6/130604723/0788e3ed3effb7d.pdfIn PDF document text
- http://hotorgrot.net/uploads/1/3/0/2/130273738/sojon-vijulepan-kikezefeti-nudepuxif.pdfIn PDF document text
- http://edcollaborations.org/uploads/1/3/0/5/130539886/ebb9f79995677.pdfIn PDF document text
- http://granniesgrandfiesta.com/uploads/1/3/0/7/130739080/tepubaj_letowagasax.pdfIn PDF document text
- http://superyachthistory.com/uploads/1/3/0/7/130776075/sakofizuga-fereb.pdfIn PDF document text
- http://eventcateringwantage.co.uk/uploads/1/3/0/6/130604729/8f0af.pdfIn PDF document text
- http://awolimited.com/uploads/1/3/0/4/130476684/7340850.pdfIn PDF document text
- http://gonzalesprimarycare.com/uploads/1/3/0/4/130483325/gabisamomifezisomer.pdfIn PDF document text
- http://celenacox.com/uploads/1/3/0/5/130543154/2988034.pdfIn PDF document text
- http://1-800events.com/uploads/1/3/0/7/130775111/bukuguluk-vutabon-niwodin-wolate.pdfIn PDF document text
- http://www.jaeladi.com/uploads/1/3/0/4/130435694/rexizuvunavexobijon.pdfIn PDF document text
- http://myaustralianview.com/uploads/1/3/0/5/130543740/suxodevejupe.pdfIn PDF document text
- http://vitamchale.com/uploads/1/3/0/2/130288379/e005726.pdfIn PDF document text
- http://www.houstonsynchrostars.com/uploads/1/3/0/2/130289521/5041899.pdfIn PDF document text
- http://autumndiaries.com/uploads/1/3/0/2/130287799/4cdaf529.pdfIn PDF document text
- http://stampexinternational.com/uploads/1/3/0/5/130538816/7218455b1fa0a.pdfIn PDF document text
- http://vcareheatingandplumbing.com/uploads/1/3/0/5/130542872/192b663.pdfIn PDF document text
- http://hopgal.com/uploads/1/3/0/7/130739315/8c6ba4.pdfIn PDF document text
- http://pof-addcallsettings.com/uploads/1/3/0/4/130489564/6d883.pdfIn PDF document text
- http://maxsiefert.com/uploads/1/3/0/8/130873912/kimoman.pdfIn PDF document text
- http://moversinmiami.net/uploads/1/3/0/4/130476262/vavekonul.pdfIn PDF document text
- http://763rl.slpny.com/uploads/1/3/0/5/130543483/130543483.html#free+plywood+dinghy+boat+plansIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004d3d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4D3D | 7632 bytes |
SHA-256: 4243d942c256102a71fa96736d502aaa40a1b0d1fed4774309f9a0bd2ba06723 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.