MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, directing users to download other PDF files. The document body, though partially corrupted, suggests a lure related to educational materials ('Kcse past papers 2016 with answers'). This indicates a phishing or content-luring campaign designed to distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://buzevogijuxebil.weebly.com/uploads/1/3/0/5/130543134/668ac8edfd.pdf
- http://blackmarksproduction.com/uploads/1/3/0/3/130379098/kojajotizuvido.pdf
- http://nutritiongirl.org/uploads/1/3/0/6/130621401/713054235e0d.pdf
- http://trophypointcontracting.com/uploads/1/3/0/4/130483230/5465502.pdf
- http://nataliefernadez.com/uploads/1/3/0/6/130639770/5fd49c33.pdf
- http://thecovfefefile.com/uploads/1/3/0/5/130550874/4150405.pdf
- http://aysenurguler.com/uploads/1/3/0/6/130621964/zumug-menowufux-xokozad.pdf
- http://fetagumalo.bikerpublic.com/uploads/2020/01/29/karagu.pdf
- http://chaiyee.com/uploads/1/3/0/5/130550711/279afc756.pdf
- http://nifinadaki.ilikepizza.ru/uploads/2020/01/28/6422765.pdf
- http://texassaddlefitter.com/uploads/1/3/0/6/130605493/takoganatesin_valesonidaje_kekokevedinefu.pdf
- http://arowedesignsshop.com/uploads/1/3/0/3/130379523/a841b4965d1.pdf
- https://tiroxogube.weebly.com/uploads/1/3/0/5/130590672/fde89704.pdf
- http://ramonmaciamusica.com/uploads/1/3/0/6/130604247/1329489.pdf
- http://midwaytacticalgear.com/uploads/1/3/0/2/130289163/zazomuraneni.pdf
- http://miztcomedy.com/uploads/1/3/0/6/130620578/9660874.pdf
- http://venofujuw.prorealgame.ru/uploads/2020/01/28/7576297.pdf
- http://bobisanerd.com/uploads/1/3/0/5/130588508/kuberimunemi-sifenetotomane-kurefajuwewiris-rekak.pdf
- http://mlstourney.com/uploads/1/3/0/5/130540823/pepiberusir.pdf
- https://jarezuvarasor.weebly.com/uploads/1/3/0/5/130538842/gofemagi.pdf
- http://desertskydoodles.com/uploads/1/3/0/2/130289341/wabifewukinop.pdf
- http://chickadeerevisions.com/uploads/1/3/0/2/130271244/ponowolas-jonuvufixu-junomudunetitok-mitefufulepiz.pdf
- http://okpromotional.com/uploads/1/3/0/4/130489038/fodikaxugita_zilimeko.pdf
- http://colorfulstudio.ru/uploads/2020/01/28/metotunitu-xakaso-kadosejajafol-vuvitapesasa.pdf
- http://thesingbabysingshow.com/uploads/1/3/0/2/130270941/130270941.html#kcse+past+papers+2016+with+answers
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000184c.binc1b0e5eb16ba9d7430f33b41213364f95f7fec540bddc63da2b9ea278c3c9710 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x184C | 8292 bytes |
font_01_sfnt_off00009fb3.bind907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9FB3 | 2616 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.