MALICIOUS
172
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of embedded URLs, forming a link farm. This is strongly indicative of a phishing or malware distribution campaign, as the document itself does not appear to contain substantial content beyond these links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTHA PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://eacenter.org/uploads/1/3/0/3/130323581/6481170.pdf In PDF document text
- http://marketyourselfsmarter.com/uploads/1/3/0/7/130739542/9909c593336.pdfIn PDF document text
- http://akronglobal.net/uploads/1/3/0/6/130621995/3725677.pdfIn PDF document text
- http://bambus.group/uploads/1/3/0/7/130776801/tojumedixutowobu.pdfIn PDF document text
- http://publiceyenetwork.net/uploads/1/3/0/5/130588670/majom.pdfIn PDF document text
- http://norcalsetac.net/uploads/1/3/0/6/130620614/4329622.pdfIn PDF document text
- http://tahmoorbaptistchurch.com/uploads/1/3/0/3/130323755/fuxureji.pdfIn PDF document text
- http://stasytyte.com/uploads/1/3/0/5/130539338/8113325.pdfIn PDF document text
- http://irfanbukhari.com/uploads/1/3/0/6/130603753/tutabeb.pdfIn PDF document text
- http://ngoji.com/uploads/1/3/0/3/130379821/tawagekowawo.pdfIn PDF document text
- http://aloha-sugar.com/uploads/1/3/0/5/130545185/simufut-larebetisetal-xutufovemonika-repunipirek.pdfIn PDF document text
- http://matio3d.com/uploads/1/3/0/8/130814235/2360602.pdfIn PDF document text
- http://www.lillyhouseofbeauty.com/uploads/1/3/0/6/130620302/02014573bc1b9bc.pdfIn PDF document text
- http://beverlyhillsboba.com/uploads/1/3/0/8/130814247/836313.pdfIn PDF document text
- http://investlifebalance.com/uploads/1/3/0/4/130476143/3dad0.pdfIn PDF document text
- http://wildernessadventureswest.com/uploads/1/3/0/5/130588695/4047584.pdfIn PDF document text
- http://makeartaliving.com/uploads/1/3/0/6/130640057/nuwemezaxovo_bamataru_duzafofojezo.pdfIn PDF document text
- http://webmail.bardosdiamondsports.com/uploads/1/3/0/5/130539936/130539936.html#radial+nerve+pain+dogIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001649.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1649 | 8788 bytes |
SHA-256: 684376929a6f902bad3214d64b670ac51bf3c11e88d14d5e81d5ae5d1a29be1c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.