MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, with the first identified URL being http://viprealtorclub.com/uploads/1/3/0/5/130588744/sefat.pdf. This suggests the document's primary purpose is to redirect users to potentially malicious content or to engage in SEO spam. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://viprealtorclub.com/uploads/1/3/0/5/130588744/sefat.pdf In PDF document text
- http://zabrano.co.uk/uploads/1/3/0/5/130590154/tuguxufurum.pdfIn PDF document text
- http://allidphotography.org/uploads/1/3/0/4/130435679/09ba06cedfba74.pdfIn PDF document text
- http://circumchange.ca/uploads/1/3/0/5/130588463/e55e0a9d6d5090.pdfIn PDF document text
- http://freebearproject.org/uploads/1/3/0/4/130489841/baxiboxomibuvixema.pdfIn PDF document text
- http://libertodos.org/uploads/1/3/0/5/130541597/nedam-tatadopuzopisod.pdfIn PDF document text
- http://williamclegg.com/uploads/1/3/0/7/130740627/5972026.pdfIn PDF document text
- http://www.secrettreasuresuk.com/uploads/1/3/0/6/130620881/litozogomu-sozizonebovepog-lisenovejisuwa-rejoj.pdfIn PDF document text
- http://deanvukelicstonemason.com/uploads/1/3/0/5/130540642/5484660.pdfIn PDF document text
- http://ah-reviews.com/uploads/1/3/0/7/130738725/femebijuruzo.pdfIn PDF document text
- http://nevadachallenger.net/uploads/1/3/0/7/130775758/wiwerik.pdfIn PDF document text
- http://joshandaprilbrand.com/uploads/1/3/0/6/130621516/puwafu-jejafufonexo-jasumukawisol-gukefor.pdfIn PDF document text
- http://universitynest.com/uploads/1/3/0/5/130589198/90b6c5762fbea.pdfIn PDF document text
- http://easycompmx.com/uploads/1/3/0/7/130776582/vejulir_dufevonisitavi_nepopoxu_ruzaj.pdfIn PDF document text
- http://arcticethics.org/uploads/1/3/0/8/130873783/zugeguzeforuxidaxa.pdfIn PDF document text
- http://danielstorage.com/uploads/1/3/0/7/130739986/e87dcc.pdfIn PDF document text
- http://cedricbrunelle.com/uploads/1/3/0/7/130775055/a43597638b21.pdfIn PDF document text
- http://lmathletics.org/uploads/1/3/0/5/130550914/zekafoladitajufam.pdfIn PDF document text
- http://smarttravelhelpline.com/uploads/1/3/0/2/130287505/vubizujawiwizerep.pdfIn PDF document text
- http://salonbeauchesnestudio.com/uploads/1/3/0/6/130604805/31649.pdfIn PDF document text
- http://65bancker.com/uploads/1/3/0/8/130874223/130874223.html#susp+typhoid+fever+adalahIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003fd5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3FD5 | 7452 bytes |
SHA-256: a636876d2020bd72a325ffe143a05a492feaaca4363d16dc6f7c745f200afef7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.