MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though heavily corrupted, mentions 'Methodology of teaching english to young learners pdf', which may be a lure to disguise the malicious nature of the links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://vizcademy.com/uploads/1/3/0/6/130639461/jisebawo.pdf In PDF document text
- http://jamesagibson.com/uploads/1/3/0/3/130379485/60a663094.pdfIn PDF document text
- http://jonathanecollins.com/uploads/1/3/0/4/130476628/6388882.pdfIn PDF document text
- http://www.angels-whispers.com/uploads/1/3/0/5/130590663/weluk.pdfIn PDF document text
- http://yasr.com/uploads/1/3/0/6/130604523/70faa2.pdfIn PDF document text
- http://www.poetrinmotion.com/uploads/1/3/0/7/130740458/7889269.pdfIn PDF document text
- http://nederland-verzilvert.nl/uploads/1/3/0/4/130435553/zalifexomef-mesaga-muxaxoz.pdfIn PDF document text
- http://misshitch.net/uploads/1/3/0/6/130622103/2159689.pdfIn PDF document text
- http://www.myhudsonair.com/uploads/1/3/0/3/130323130/7371844.pdfIn PDF document text
- http://newmarketviolinstudio.com/uploads/1/3/0/5/130551576/palegaru.pdfIn PDF document text
- http://wimberlesque.com/uploads/1/3/0/9/130969647/9443812.pdfIn PDF document text
- http://ccbucciero.com/uploads/1/3/0/4/130488311/891760.pdfIn PDF document text
- http://realitycure.com/uploads/1/3/0/6/130621608/jomijoj-tomira-nobunifazenike-resek.pdfIn PDF document text
- http://vantagetactical.net/uploads/1/3/0/4/130483396/zusilofumi.pdfIn PDF document text
- http://www.paralectures.net/uploads/1/3/0/5/130545882/7612961.pdfIn PDF document text
- http://espanolvistarealguatemala.devsite-1.com/uploads/1/3/0/6/130605059/130605059.html#methodology+of+teaching+english+to+young+learners+pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000051fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51FC | 16268 bytes |
SHA-256: 5d6225cbdc4288516ed7fbc301dd3fbd9b41a0934790722d8e3da1cedfe45191 |
|||
font_01_sfnt_off00006a4c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6A4C | 7832 bytes |
SHA-256: 165fa079fa49c03f1dbbfcc879eb6cc666a329d1a1b61386570f252a1930a543 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.