MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body itself appears to be corrupted or contains irrelevant text, but the primary malicious activity is the extensive link farm.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://fhs1969.com/uploads/1/3/0/4/130435734/taxak_puzagasamiris_lijabiruv_masogolijofet.pdf In PDF document text
- http://americanmusicnews.com/uploads/1/3/0/6/130639418/fe205ba4d67c.pdfIn PDF document text
- http://reveil-corporel.com/uploads/1/3/0/3/130324152/nitumofu.pdfIn PDF document text
- http://missinglinkbrewing.co.uk/uploads/1/3/0/5/130588461/wokotewa-tikala.pdfIn PDF document text
- http://sonoratradingpost.net/uploads/1/3/0/6/130605248/c19aa.pdfIn PDF document text
- http://themasher.net/uploads/1/3/0/5/130550949/dbde45.pdfIn PDF document text
- http://www.southbaybaby.com/uploads/1/3/0/6/130604046/3221596.pdfIn PDF document text
- http://electmorthland.com/uploads/1/3/0/6/130639559/tesujabalu.pdfIn PDF document text
- http://fearhouse.net/uploads/1/3/0/9/130969164/198de8f66.pdfIn PDF document text
- http://taskforce38.org/uploads/1/3/0/6/130620670/ripanigem-peguneri-lisozuweta-wafikiwexawipus.pdfIn PDF document text
- http://hostmaster.soleiragreen.com/uploads/1/3/0/6/130639412/73490.pdfIn PDF document text
- http://amywoodsbooks.com/uploads/1/3/0/6/130621089/9603593.pdfIn PDF document text
- http://jestersdesigns.com/uploads/1/3/0/7/130776749/1e26d82.pdfIn PDF document text
- http://naomiquinnphotography.com/uploads/1/3/0/4/130483322/zizizadutibunug.pdfIn PDF document text
- http://mta-sts.amateurhorsesales.com/uploads/1/3/0/7/130775075/rolekot.pdfIn PDF document text
- http://www.irenedkapinga.com/uploads/1/3/0/5/130588320/1223558.pdfIn PDF document text
- http://tuesdays4.com/uploads/1/3/0/3/130313415/tadaxuji-fibefa-nojoz-naxujanofe.pdfIn PDF document text
- http://travelbysharon.voyagerwebsites.com/uploads/1/3/0/7/130738632/130738632.html#download+279+ielts+essays+sample+pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004dfa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4DFA | 17460 bytes |
SHA-256: 0acfc91a9332707a6be289fc4a0162b2ff3fb685652a1d34c8019039313e2bf6 |
|||
font_01_sfnt_off00006ab7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6AB7 | 9664 bytes |
SHA-256: d650b32b076efaaf6e3f3cd7682c4350ae5c512bb886aca6830af68c97e41604 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.