MALICIOUS
192
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. It contains a large number of embedded external links, indicating a link farm designed to distribute traffic to other malicious sites. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document may also be instructing users to open a password-protected archive, a common tactic to bypass security scanners. The document body itself is heavily obfuscated and does not provide clear textual lures.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mindandbodydallas.com/uploads/1/3/0/3/130379206/796818.pdf In PDF document text
- http://eltomatemasrico.com/uploads/1/3/0/6/130639059/mifejubukowunet-munese.pdfIn PDF document text
- http://narlee.design/uploads/1/3/0/5/130545818/1d324fe.pdfIn PDF document text
- http://self-healing-effect.com/uploads/1/3/0/8/130813037/vexenezaw_zapubopo.pdfIn PDF document text
- http://prettylittlethings.ca/uploads/1/3/0/6/130621293/8d746e9df1.pdfIn PDF document text
- http://classicmassagestudio.com/uploads/1/3/0/4/130489023/90af48e9947ef9e.pdfIn PDF document text
- http://www.faiza-portfolio.com/uploads/1/3/0/6/130603966/vixogidufu_bajipaban_zefibowujonare_kakar.pdfIn PDF document text
- http://entrepedia.org/uploads/1/3/0/3/130313038/vobuxexilomor.pdfIn PDF document text
- http://jurandirsilva.com/uploads/1/3/0/4/130477490/nomatajidoru-zovumagu-rozumadujezazo.pdfIn PDF document text
- http://thetruyoucanada.ca/uploads/1/3/0/6/130604198/ranajuvuxupot-zatefowim-zunalikuxel.pdfIn PDF document text
- http://c5events.ca/uploads/1/3/0/8/130813975/5415001.pdfIn PDF document text
- http://sms.shelbyvillebands.com/uploads/1/3/0/6/130622042/6963297.pdfIn PDF document text
- http://10thavenuerebuilders.com/uploads/1/3/0/7/130739251/kuporuxutademoz.pdfIn PDF document text
- http://hillingdonmotors.com/uploads/1/3/0/2/130270932/dinebafewetali-pufijome.pdfIn PDF document text
- http://iachassociation.com/uploads/1/3/0/5/130544703/a80f368d67.pdfIn PDF document text
- http://blushcolumbus.com/uploads/1/3/0/8/130814293/lazulajeb.pdfIn PDF document text
- http://nogginblocks.net/uploads/1/3/0/5/130543158/podesiguretib.pdfIn PDF document text
- http://leadershipmartialartsacademy.com/uploads/1/3/0/4/130492963/gofipuxus.pdfIn PDF document text
- http://staywhole.net/uploads/1/3/0/6/130621846/tibosa_kululi_xawix.pdfIn PDF document text
- http://mytriptojapan.com/uploads/1/3/0/6/130604956/130604956.html#vulnerability+assessment+software+toolsIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003ecb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3ECB | 7636 bytes |
SHA-256: c3376e730444075c07fdcc4b0eb61f3643b704382ec0958cf7c36f05fd786a8f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.