MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection strongly support its malicious nature, classifying it as phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ineavet.com/uploads/1/3/0/5/130550664/7197190.pdf In PDF document text
- http://lonlelyphotographer.online/uploads/1/3/0/7/130775974/fejapodo.pdfIn PDF document text
- http://mjrblogspot.com/uploads/1/3/0/4/130435726/9683179.pdfIn PDF document text
- http://heidiimmler.com/uploads/1/3/0/6/130604708/02a7d0e8.pdfIn PDF document text
- http://www.drsmartphonesfc.com/uploads/1/3/0/6/130621376/c361e20d379.pdfIn PDF document text
- http://farber.ca/uploads/1/3/0/6/130621909/mamozesinojun_negadomogu_sedux_momemawaj.pdfIn PDF document text
- http://deannapaulsen.com/uploads/1/3/0/7/130776754/xekoxafaruwilik-xozudixabif-bivuvedija-vozigi.pdfIn PDF document text
- http://espaijove.info/uploads/1/3/0/6/130620751/7ffd75de7b8eee5.pdfIn PDF document text
- http://somersetfoodtrail.org/uploads/1/3/0/3/130313176/9362902.pdfIn PDF document text
- http://annearundelhandcenter.com/uploads/1/3/0/5/130543155/4702503.pdfIn PDF document text
- http://paddlebp.com/uploads/1/3/0/3/130323400/pekugolole-vopezedowekus.pdfIn PDF document text
- http://lafamiliaojeda.net/uploads/1/3/0/2/130274091/pulubod.pdfIn PDF document text
- http://mmorrisld.com/uploads/1/3/0/3/130313345/gitabevukiwixisol.pdfIn PDF document text
- http://nlwatercolor.net/uploads/1/3/0/3/130313122/2542700.pdfIn PDF document text
- http://estoreone.net/uploads/1/3/0/3/130313398/fesix.pdfIn PDF document text
- http://atrendyblogwithmeg.com/uploads/1/3/0/3/130323174/6258714.pdfIn PDF document text
- http://autosafenow.com/uploads/1/3/0/4/130488759/ba9099.pdfIn PDF document text
- http://silktailor.ca/uploads/1/3/0/8/130814052/kovewor.pdfIn PDF document text
- http://huangjiayulezhinan.br3h.com/uploads/1/3/0/7/130776415/130776415.html#learning+tenses+in+english+grammar+in+hindiIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign:
espaijove.info
3 samples
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000046a6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x46A6 | 1388 bytes |
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0 |
|||
font_01_sfnt_off00004e78.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E78 | 8944 bytes |
SHA-256: d179794f61ac35fd4f3d72a9fe8d180b1530b28c1c369e3f8418ed3686703cfd |
|||
font_02_sfnt_off000068f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x68F0 | 7796 bytes |
SHA-256: df78384e942b96a48e24bd94c9b3ffd492b93cd1b3a9f65da6c307d3258b1ecc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.