MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of phone numbers, indicating a phone scam. It also embeds multiple URLs, one of which is directly referenced in the document body, suggesting an attempt to redirect the user to a malicious site for further exploitation. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports the phishing and redirection nature of this document.
Machine Learning
- Nyx PDF Classifier clean score 0.0568
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAMDocument repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://koreanchurchofmemphis.org/uploads/1/3/0/5/130590375/355eccc5.pdf PDF link annotation
- http://alstart.co.uk/uploads/1/3/0/4/130436171/jawesalemudij-tunizozilipe.pdfIn PDF document text
- http://synod-sl.info/uploads/1/3/0/4/130488669/fenubetajizip.pdfIn PDF document text
- http://johnhdoe.org/uploads/1/3/0/5/130550763/8537665.pdfIn PDF document text
- http://mail.discountfireworks.us/uploads/1/3/0/5/130539871/8467689.pdfIn PDF document text
- http://dromorens.com/uploads/1/3/0/6/130621277/lopujelanador.pdfIn PDF document text
- http://layanshaheen.com/uploads/1/3/0/7/130738647/vepixe.pdfIn PDF document text
- http://carpetcleanerwaukesha.com/uploads/1/3/0/3/130313507/lalomopo-fofoxulaka-xixenurome.pdfIn PDF document text
- http://appel-stores.shop/uploads/1/3/0/5/130551536/sejovojatane-benemoz.pdfIn PDF document text
- http://www.frenchconnectionoutfitter.com/uploads/1/3/0/4/130478663/vefemosopi-rabapen-bexuva.pdfIn PDF document text
- http://mta-sts.mail.antonyknights.com/uploads/1/3/0/8/130874613/c2cde1b9e75.pdfIn PDF document text
- http://sirwaddlesworths.com/uploads/1/3/0/6/130604841/filuzof.pdfIn PDF document text
- http://carlsbadcleaningservices.com/uploads/1/3/0/6/130604287/5cd8c1f8a.pdfIn PDF document text
- http://xruca0.salon225.com/uploads/1/3/0/7/130738870/130738870.html#canadian+aviation+regulations+english+pdfIn PDF document text
- http://www.ascendercorp.com/In extracted file (font_02_sfnt_off00083445.bin)
- http://www.ascendercorp.com/typedesigners.htmlIn extracted file (font_02_sfnt_off00083445.bin)
- http://dejavu.sourceforge.netIn extracted file (font_01_sfnt_off0000baec.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_01_sfnt_off0000baec.bin)
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn extracted file (font_02_sfnt_off00083445.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002617.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2617 | 10712 bytes |
SHA-256: e38aa3e88b6ac642bc7f9fa3c2756c3cf63ec3e7809299f3b9019d3d9b42a1a2 |
|||
font_01_sfnt_off0000baec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBAEC | 16036 bytes |
SHA-256: f335bbb8769c533cbca16f6384a9be7e2e65528b9693bf598f9b6a21ed261b2e |
|||
font_02_sfnt_off00083445.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x83445 | 2644 bytes |
SHA-256: 3df661b3efd58e4fa5e6627d7e2a16454c72c3f737f3bec639f179f03166415d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.