MALICIOUS
192
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a tactic to manipulate search engine results or distribute malicious content. The ClamAV detection further confirms its malicious nature. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.drumvoice.org/uploads/1/3/0/5/130546283/3576958.pdf In PDF document text
- http://elevateinsightla.com/uploads/1/3/0/3/130312984/wabezofosevafojusulu.pdfIn PDF document text
- http://www.riversofthekindgom.org/uploads/1/3/0/6/130639396/3972362.pdfIn PDF document text
- http://thomasandreeseco.com/uploads/1/3/0/8/130814871/lesibibumexoguzajo.pdfIn PDF document text
- http://healmyhorse.org/uploads/1/3/0/7/130740514/78e8e65aa.pdfIn PDF document text
- http://nekima.net/uploads/1/3/0/7/130739139/3242282.pdfIn PDF document text
- http://jhphotograph.com/uploads/1/3/0/6/130640104/95ec6.pdfIn PDF document text
- http://midlandsfestivalofflight.com/uploads/1/3/0/3/130323120/03e554af.pdfIn PDF document text
- http://www.mrbeavercreek.com/uploads/1/3/0/5/130543368/wubuwuruka-xenokila-xetulipuzuzof.pdfIn PDF document text
- http://midnightepiphanymusic.net/uploads/1/3/0/4/130435590/d062408f5e8c78f.pdfIn PDF document text
- http://premioscocacola.com/uploads/1/3/0/2/130287835/gebelumi_fenomekedebezo_pofefiraninijar.pdfIn PDF document text
- http://myguillermofloresuagro.net/uploads/1/3/0/6/130639235/0f9c496454.pdfIn PDF document text
- http://northwesthennepinfamilyservicecollaborative.com/uploads/1/3/0/4/130488698/1248886.pdfIn PDF document text
- http://michelleblanchette.org/uploads/1/3/0/2/130287852/duzenanizojukazoguwi.pdfIn PDF document text
- http://www.rawxandra.com/uploads/1/3/0/4/130488100/faf1c9812536.pdfIn PDF document text
- http://x0729992xstreamtravel.xsideas.com/uploads/1/3/0/7/130776684/130776684.html#diferencia+entre+acidosis+respiratoria+y+metabolicaIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000031c8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x31C8 | 8884 bytes |
SHA-256: ef80347697907aea962d77978436a44fccfe8dac2dc9ef55822c6c854a6620fb |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.