MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The document body itself is heavily obfuscated and does not provide clear user-facing content, but the heuristic firings strongly indicate a link-farming or redirection attack.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://myservicecenter.ru/uploads/2020/01/28/2613617c138d5b.pdf
- http://nethandilin.fo/uploads/1/3/0/2/130273748/b60af880599a.pdf
- http://norwooddentalblog.com/uploads/1/3/0/4/130483684/vamerudada.pdf
- http://sandravictoria.weebly.com/uploads/1/3/0/6/130620961/1662176.pdf
- http://onlytopsaler.site/uploads/1/3/0/2/130289308/4030b.pdf
- http://jas.event-essence.com/uploads/2020/01/28/wazikilawe.pdf
- http://harrisonashtonphoto.com/uploads/1/3/0/6/130604419/484762.pdf
- http://middletnapic.org/uploads/1/3/0/5/130543053/6662394.pdf
- http://mivorek.whitection.ru/uploads/2020/01/28/kelipuvifabu_loxilamanulok_vugoliwibosebi.pdf
- https://xipiwizagemodo.weebly.com/uploads/1/3/0/3/130312986/ronavuvupige.pdf
- http://mysistershouseonline.org/uploads/1/3/0/6/130620747/xamuvo_towek_mugidapoditona.pdf
- http://killjoy.info/uploads/1/3/0/3/130313156/debosujevit.pdf
- http://regafe.angelis-spa.com/uploads/2020/01/29/gominaremorivobub.pdf
- http://bendigolab.com/uploads/1/3/0/6/130604838/bibiladazades_vurolur_xasil_jigaxafamiro.pdf
- http://staceyjanedouglas.com/uploads/1/3/0/6/130621882/niwunawufufibi-zozitu.pdf
- http://sisterhood-of-prosperity.club/uploads/1/3/0/4/130491850/9038215.pdf
- http://txa4d.com/uploads/1/3/0/5/130551271/c7c4709425.pdf
- http://callanjames.co.nz/uploads/1/3/0/6/130604703/a4469.pdf
- http://dozuvuwawo.wapfan.ru/uploads/2020/01/28/d923f66d6.pdf
- http://minixclusive.com/uploads/1/3/0/5/130550742/joladekivizaf_bilagitebagabes_petod.pdf
- http://northern-carbon.com/uploads/1/3/0/5/130589442/pogesip_vikajuwo.pdf
- http://beckandclem.com/uploads/1/3/0/6/130620340/9111077.pdf
- http://diabetesrelatedretinopathy.org/uploads/1/3/0/5/130551006/8658834.pdf
- http://mysterclothingbrand.com/uploads/1/3/0/6/130604508/b8cbc559c8f8790.pdf
- http://morrowtimes.com/uploads/1/3/0/4/130489262/mujuru_dewupe_gomumusabanuru.pdf
- http://cecilyeiferle.com/uploads/1/3/0/4/130436450/130436450.html#viking+raid+newspaper+report
- http://sisterhood-of-prosperity.club/uploads/1/3/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001583.binc888cc337a44bfee27ee5ba723fee16313d16e70871d853c79d39b2dc9f3bc83 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1583 | 8328 bytes |
font_01_sfnt_off0000aa12.binb5cbe6ae889a1b57a3239b72842f1e8072b64006066540b74ef2739d8d38d7e3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xAA12 | 2052 bytes |
font_02_sfnt_off0000b330.binc45ecc3521217a1dc016c14e045d78f78e0d194bf1e1893e402d944f9961a49f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB330 | 16080 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.