MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a large number of external links to other PDF files, a technique commonly used for SEO poisoning and phishing lures. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a campaign to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://borough18mc.com/uploads/1/3/0/2/130274017/ccd3aa309f5.pdf
- http://opossumpouchwildlife.com/uploads/1/3/0/5/130589000/wuseb-mibema.pdf
- http://koiriensijaiskoti.com/uploads/1/3/0/7/130776016/97eaf.pdf
- http://kb-mtr.com/uploads/1/3/0/5/130588621/jibagomopuwiborar.pdf
- http://dz-explosive.net/uploads/1/3/0/4/130476505/jikatexazuduravij.pdf
- http://sacredawakeningandhealing.com/uploads/1/3/0/3/130379113/lidipexo_rumuda_kulafexiputile.pdf
- http://www.thegouldfamily.org/uploads/1/3/0/3/130313221/fijesus-garexuvobotoxe-judagog.pdf
- http://allancapital.ca/uploads/1/3/0/4/130436190/rusozatodunato_tezumugotiwidar_golesibezi.pdf
- http://festivallatinosacramento.com/uploads/1/3/0/5/130544090/sudewujuva.pdf
- http://daytonheritagemuseum.org/uploads/1/3/0/7/130739629/vanilunalejibewi.pdf
- http://strongfamily.info/uploads/1/3/0/5/130540477/xaminopedodun.pdf
- http://ecuadoroscuro.com/uploads/1/3/0/7/130740264/rofujitojusefozu.pdf
- http://mysss.ca/uploads/1/3/0/4/130483909/kewewujuzozadow-pukafalupexudal.pdf
- http://hypergrid.xyz/uploads/1/3/0/4/130436139/lariponuxobusuduve.pdf
- http://trvlrad.com/uploads/1/3/0/7/130775371/8831211.pdf
- http://nashobavalleyextractco.com/uploads/1/3/0/7/130740141/wironutojaxadorepi.pdf
- http://www.alanamarieartworks.ca/uploads/1/3/0/7/130775808/xukiwa.pdf
- http://badengyulechengdailizhuce.f18.ebkf.org/uploads/1/3/0/7/130738625/a64e3e48c.pdf
- http://shoebrewnation.com/uploads/1/3/0/6/130639875/8439840dd55d.pdf
- http://lucashauptmann.com/uploads/1/3/0/4/130488539/gediwu_litifofejoza_xiwazivowedebab_sedumosusodog.pdf
- http://restorationfellowshipchurchwv.com/uploads/1/3/0/6/130620640/minupofate-nagezikumaja-gijevesem.pdf
- http://mainstreetnewjersey.net/uploads/1/3/0/6/130639336/dd5543febd.pdf
- http://clubatlantis.co/uploads/1/3/0/4/130476048/dubalilerodilej.pdf
- http://pawtasticpetsitters.com/uploads/1/3/0/6/130603968/7276069.pdf
- http://sta-66-99-58-197.ladse.org/uploads/1/3/0/6/130621675/130621675.html#abraham+maslow+biographical+information
- http://mainstreetnewjersey.net/uploads/1/3/0/6/130639336/dd554
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002d25.bind6953824df5c0cab3d4f97f5ff62ed10bda4d2de7c35790999d97264ecb0fea6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2D25 | 8984 bytes |
font_01_sfnt_off0000f5be.bin9c70772738280065930db61d29b0eee79557f8152c8dc8c27cbb99d0b6b3e0b3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5BE | 16200 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.