MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1566.002 Spearphishing Link
The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a mass external link farm. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', further supporting a malicious intent. No scripts were extracted, so the primary attack vector appears to be the redirection to external resources.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://jitorevov.lek.moscow/uploads/2020/01/29/xusamagusif.pdf
- http://fibes.marketing-digital.ru/uploads/2020/01/28/b41d8baf62.pdf
- http://renewair.org/uploads/1/3/0/4/130476485/lebututopuvot.pdf
- http://taza.techindulgence.com/uploads/2020/01/28/vokebopusisiviveno.pdf
- http://mogafabun.minzdravua.club/uploads/2020/01/28/8e498d989f62de.pdf
- http://contractgovernmentservices.com/uploads/1/3/0/4/130476346/f376fd3eb57.pdf
- https://gafojagitaw.weebly.com/uploads/1/3/0/4/130483584/7093893e3f766.pdf
- http://myultimatecuts.com/uploads/1/3/0/5/130588875/4988951.pdf
- https://wudoruba.weebly.com/uploads/1/3/0/4/130435941/497003.pdf
- https://jugajilir.weebly.com/uploads/1/3/0/4/130479350/xuxozuk.pdf
- https://wafunelitidiko.weebly.com/uploads/1/3/0/5/130541133/394385.pdf
- http://431775997417950473.com/uploads/1/3/0/3/130313445/545e9b4d28b615.pdf
- http://theghosttours.com/uploads/1/3/0/5/130539437/9083643.pdf
- http://like-ball.com/uploads/2020/01/27/6719602.pdf
- https://mixaporuwore.weebly.com/uploads/1/3/0/5/130550679/mobemejurexawaraji.pdf
- http://folipazure.ts3update.info/uploads/2020/01/28/e0cf87c569b7fc.pdf
- https://welexuzofom.weebly.com/uploads/1/3/0/2/130272579/2120826.pdf
- http://phraseologychoir.com/uploads/1/3/0/5/130588718/xagovamakirago.pdf
- http://mariya-kudriashova.com/uploads/2020/01/27/ccb4e654f583504.pdf
- https://zaverumejas.weebly.com/uploads/1/3/0/3/130379581/wefigeborejel.pdf
- http://fef.luckypays.com/uploads/2020/01/29/5d9b53b134f.pdf
- http://ludog.startyachting.ru/uploads/2020/01/27/sajumif-zusazigidoze-fulonex.pdf
- http://bunetili.oracul.pro/uploads/2020/01/27/tazevitezukaxebelaw.pdf
- http://jajutupux.powking1.ru/uploads/2020/01/28/fokufuvedum-forasema-bafudok.pdf
- http://bakeline.ca/uploads/1/3/0/5/130539496/130539496.html#yamaha+thr10+patches
- http://ludog.startyachting.ru/uploads/2020/01/27/sajumif-zusazig
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001905.binf3dbf5b62bcf182ec73779f15fd936eaa44c1d07ca4b4370ef1ee725cd77abb9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1905 | 9408 bytes |
font_01_sfnt_off0000734b.bin6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x734B | 16068 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.