MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of embedded URLs pointing to external PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.
Machine Learning
- Nyx PDF Classifier malicious score 0.9987
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://nostalgist.net/uploads/1/3/0/5/130543980/2615050.pdf
- http://nwcg.yourgin.com/uploads/1/3/0/6/130622023/kukuw.pdf
- http://turnred.com/uploads/1/3/0/4/130436165/tibisowobunulu-surifejeniribu-zubesaw.pdf
- http://retreatsinjapan.com/uploads/1/3/0/5/130540823/6554682.pdf
- http://mivomaskin.no/uploads/1/3/0/6/130621075/7228586.pdf
- http://daddysduties.com/uploads/1/3/0/7/130775950/1400793.pdf
- http://sennad.store/uploads/1/3/0/6/130604090/8819833.pdf
- http://interstellarbrands.com/uploads/1/3/0/7/130775109/c18baa315956ad5.pdf
- http://tdf20years.com/uploads/1/3/0/5/130590719/fakaveresupejatobilu.pdf
- http://mpowerempire.com/uploads/1/3/0/6/130604657/4119713.pdf
- http://growtem.com/uploads/1/3/0/7/130775622/davorewaj-ziriladun-vewuji.pdf
- http://mjvsms.ca/uploads/1/3/0/4/130490117/jopebifitul-tawiwo-tupanonaduda.pdf
- http://fpuunderground.com/uploads/1/3/0/7/130776474/2563344.pdf
- http://cristofori.online/uploads/1/3/0/4/130477287/17bbe2fd8.pdf
- http://dramaclubplays.com/uploads/1/3/0/7/130738565/f807729f7a89158.pdf
- http://wetlandecologybook.com/uploads/1/3/0/5/130540699/jerevebimup.pdf
- http://bluecrabkeyflorida.com/uploads/1/3/0/2/130289703/2539125.pdf
- http://kokavi.com/uploads/1/3/0/7/130776208/a678e37a824f1.pdf
- http://vliegendestoel.nl/uploads/1/3/0/7/130738803/54ce1df74.pdf
- http://www.designfirmseminars.com/uploads/1/3/0/3/130379205/delafufesanefodukeju.pdf
- http://bevinbranlandingham.com/uploads/1/3/0/6/130621148/tuvositibosubu.pdf
- http://musiowskyed.com/uploads/1/3/0/7/130738854/0727301b8859b.pdf
- http://reinasporunacausa.com/uploads/1/3/0/7/130739132/texod-vabigesikat.pdf
- http://digitalsystemresearch.com/uploads/1/3/0/2/130272484/gunusino.pdf
- http://wcd-3ni9vm8.mgh-r.ch/uploads/1/3/0/3/130313243/130313243.html#romeo+and+juliet+act+ii+scene+ii+summary
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004f7f.bine2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4F7F | 2652 bytes |
font_01_sfnt_off00005b7a.bin55cad3a383f5313abb176a3fee78a69083c7c1253c7ee0db82450ba8e5555c92 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5B7A | 8120 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.