MALICIOUS
192
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document is classified as malicious due to its structure, which contains a large number of embedded external links. The document body suggests a lure related to IELTS vocabulary, likely intended to trick users into clicking these links. The primary attack pattern involves a link farm designed to redirect users to potentially malicious content hosted on various domains.
Machine Learning
- Nyx PDF Classifier malicious score 1.0000
Heuristics 4
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://kelviron.com/uploads/1/3/0/7/130740127/jezenowivifufon_luwobi_kikokiw_bijajejusapam.pdf In PDF document text
- http://thefountainofjoy.org/uploads/1/3/0/4/130436166/juluvuxove.pdfIn PDF document text
- http://www.luciapazziencausticart.com/uploads/1/3/0/7/130740140/932d27ad8b0ed3f.pdfIn PDF document text
- http://www.customcolormcr.com/uploads/1/3/0/8/130874067/8905627.pdfIn PDF document text
- http://summitcybersecurityconsulting.com/uploads/1/3/0/6/130620640/40b7dcd279c7b05.pdfIn PDF document text
- http://www.gshocktokyo.com/uploads/1/3/0/6/130622038/44c63e980f5417a.pdfIn PDF document text
- http://russlazaruk.com/uploads/1/3/0/5/130540010/a778b68b345cf88.pdfIn PDF document text
- http://fyentertainment.net/uploads/1/3/0/6/130639335/15550ae4f2a.pdfIn PDF document text
- http://artoflifer.com/uploads/1/3/0/2/130287538/3b0b24a3f2cffe6.pdfIn PDF document text
- http://ravencon.org/uploads/1/3/0/7/130776040/pezawekitom_nudut_gamupi_serizasiz.pdfIn PDF document text
- http://countertruths.com/uploads/1/3/0/3/130379589/mawekapor_pulurivitefemin.pdfIn PDF document text
- http://www.futurescholarsearlylearningcenter.com/uploads/1/3/0/4/130436289/mifowerewukodil_lukelosinilixel.pdfIn PDF document text
- http://utahprospects.com/uploads/1/3/0/7/130739781/4997295.pdfIn PDF document text
- http://cheapcarinsuranceokc.com/uploads/1/3/0/7/130738639/ee82dd0e8df7f89.pdfIn PDF document text
- http://neighborhoodpage.com/uploads/1/3/0/2/130272092/284038.pdfIn PDF document text
- http://1tei2.slpny.com/uploads/1/3/0/6/130639958/130639958.html#vocabulary+for+ielts+advanced+with+answers+pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00003a4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3A4B | 16140 bytes |
SHA-256: 0f23141ba94d37b49c53016ac63a9b008a6ac8e4c4656a8d80e6725f77750189 |
|||
font_01_sfnt_off000051f9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51F9 | 7976 bytes |
SHA-256: 47de85cbf2ff954f92a348cb23eb167422fd9cf01c6d9aa3d87391fa12ff4bfb |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.