MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file contains a large number of embedded external links, many of which point to other PDF files. This behavior is indicative of a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. The document body, though heavily obfuscated, contains a list of URLs that are likely part of this distribution network.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://radiantlifeacademy.org/uploads/1/3/0/6/130639547/a90dbe57eb8b98.pdf
- http://zokixese.0406shopps01.fun/uploads/2020/01/29/vosevikil-nowuneru.pdf
- https://kawizugewel.weebly.com/uploads/1/3/0/5/130541188/0a377a255.pdf
- http://paypass.pro/uploads/2020/01/28/86baa75.pdf
- http://kirurofexu.firstcommonsense.com/uploads/2020/01/27/lomefoxu-savapumowi-kanepoxudasuze.pdf
- http://tayadsy.tech/uploads/2020/01/27/gesibunivefugi.pdf
- https://pokizizefavef.weebly.com/uploads/1/3/0/5/130588477/3716943.pdf
- http://rooflocators.com/uploads/1/3/0/5/130551777/8344037.pdf
- http://sovod.molodostbz.club/uploads/2020/01/28/492373defc65.pdf
- https://rozegotaxot.weebly.com/uploads/1/3/0/4/130436318/1131535.pdf
- http://nourishmarket.ca/uploads/1/3/0/5/130588964/nadowid_gebid_vefurivi_xiforope.pdf
- http://rukireg.yukariyorum.org/uploads/2020/01/27/wipetoronanolagiref.pdf
- http://rightofwaysolutionsllc.com/uploads/1/3/0/6/130620317/1966b0257b72a0.pdf
- https://vuwizosub.weebly.com/uploads/1/3/0/2/130287238/5118856.pdf
- http://motebe.myshop8.site/uploads/2020/01/28/d8d96fadd17646.pdf
- https://nizikivinagunel.weebly.com/uploads/1/3/0/3/130379291/7793094.pdf
- http://whatthefunkdenver.com/uploads/1/3/0/5/130539642/6208975.pdf
- http://mgkindergarten.weebly.com/uploads/1/3/0/6/130639329/mamemi-bigef.pdf
- http://mrsrcmath.weebly.com/uploads/1/3/0/3/130323522/tadaganad_jixemuvapipalu_rakubed_gejuzef.pdf
- http://migorakuso.kamera360.ru/uploads/2020/01/27/1064290.pdf
- http://thereadingrumpusroom.com/uploads/1/3/0/4/130476485/6698877.pdf
- http://nvspconiond7o3soonion.pw/uploads/2020/01/28/xapujeru.pdf
- http://vum.paulcotyantiques.com/uploads/2020/01/28/wolarobazasojug_jepatujuli_xewiguro.pdf
- http://stmarysautorepairandsales.com/uploads/1/3/0/4/130478067/130478067.html#wow+engineering+guide
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000017f0.bin2b39233718cc40753d96c76702e94c1de981ea6de5de548bf952cbffd75ef56f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17F0 | 8396 bytes |
font_01_sfnt_off00006004.bin6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6004 | 16068 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.