MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs, forming a link farm, which is a common technique for distributing malicious content or phishing pages. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates that the document's content is designed to trick users into believing they are entitled to a prize or funds, requiring them to take further action, likely by clicking on one of the provided links. The ClamAV detection further confirms the malicious nature of the file.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://pugetsoundlawgroup.net/uploads/1/3/0/9/130969438/bubadefezutena_galalijasezoben_zamixawumamap_fataganegelin.pdf
- http://brandnamewellness.com/uploads/1/3/0/6/130604192/sijozog_dutotove.pdf
- http://nickandgraceguy.com/uploads/1/3/0/2/130288419/sirasatesedibit-zukomesef.pdf
- http://blakeyhastings.com/uploads/1/3/0/4/130435962/b5fb31dd.pdf
- http://alyssavegerphotography.com/uploads/1/3/0/7/130776607/a54c58f6903.pdf
- http://sculpsurepittsburgh.info/uploads/1/3/0/5/130543020/wetomika-bifiv-pitafup.pdf
- http://buy-fedex.com/uploads/1/3/0/5/130542831/kurodukul_wavisu_bidarax_bulifire.pdf
- http://webmail.stuarts2gabon.com/uploads/1/3/0/5/130543813/8912408.pdf
- http://www.worldspiritualpower.com/uploads/1/3/0/5/130551405/8933418.pdf
- http://www.oneeastpaloalto.org/uploads/1/3/0/6/130604446/xideze_lekinavedozibex.pdf
- http://nativeuniques.com/uploads/1/3/0/5/130588790/ruxik.pdf
- http://ukdiamondlab.com/uploads/1/3/0/6/130621717/c83f5b3.pdf
- http://project58serve.org/uploads/1/3/0/5/130546024/3475305.pdf
- http://gemdes.space/uploads/1/3/0/6/130603979/4290316.pdf
- http://nmtitlesolutions.com/uploads/1/3/0/2/130270906/retejukuripazef-liroged.pdf
- http://mystgeorgesrugby.com/uploads/1/3/0/5/130543848/011f70461304.pdf
- http://tramontanafv.com/uploads/1/3/0/3/130379226/zapimipeman_nufekotamasawo_fukutumetigof.pdf
- http://nstrajectory.org/uploads/1/3/0/4/130488399/7570d278d106c.pdf
- http://mlotero.net/uploads/1/3/0/6/130604320/1e048ede9650ad9.pdf
- http://tch318journals.com/uploads/1/3/0/4/130436006/zetorafivabiw-jimijujinemijix.pdf
- http://my-genuine-life.com/uploads/1/3/0/7/130739423/laxifowosin.pdf
- http://adsl-63-204-18-31.benefitplans.org/uploads/1/3/0/8/130814390/130814390.html#2018+fifa+world+cup+match+list+pdf
- http://sculpsurepittsburgh.info/uploads/1/3/0/5/1305
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001b74.bine6651dfbee29d25a27b6069ba8c0823ce70f855b29414a55c76c323b702355a5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1B74 | 17104 bytes |
font_01_sfnt_off0001e8e3.bin7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1E8E3 | 2732 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.