MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains a large number of external links, many of which point to PDF files on various domains, indicating a link farm for SEO or phishing purposes. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly suggests the document's content is designed to trick users into paying fees for a prize or parcel. ClamAV also identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded URLs are likely used to direct users to malicious content or further phishing pages.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://brainrinsing.com/uploads/1/3/0/6/130621024/resaris.pdf
- http://autodiscover.paulsturfandtree.com/uploads/1/3/0/6/130604358/sajatapixipimovow.pdf
- http://mta-sts.mx.crchog.org/uploads/1/3/0/5/130539249/wulug.pdf
- http://communitycure.net/uploads/1/3/0/6/130639540/mijowowewir_bavifiw_vogurag.pdf
- http://swankyfork.com/uploads/1/3/0/5/130539516/8114919.pdf
- http://erinandevan.com/uploads/1/3/0/6/130621200/b0d0624e.pdf
- http://guru-inside.com/uploads/1/3/0/4/130488228/gerejuputepetubafuz.pdf
- http://kevindeuso.com/uploads/1/3/0/5/130546486/1335771.pdf
- http://immigrantsday.org/uploads/1/3/0/8/130814020/349ab.pdf
- http://dcbiggs.com/uploads/1/3/0/2/130271184/143ce836.pdf
- http://www.chemicalbathsaltsonline.com/uploads/1/3/0/5/130541743/davosevufe.pdf
- http://micheletroy.com/uploads/1/3/0/6/130603704/sararin.pdf
- http://domesticsquirrel.com/uploads/1/3/0/7/130738623/putufu.pdf
- http://benchmark-your-store.com/uploads/1/3/0/2/130289254/jowasagaketusam-wesibo.pdf
- http://precisiondecorative.com/uploads/1/3/0/5/130588754/cc6243b.pdf
- http://www.torsodecor.com/uploads/1/3/0/4/130488288/loxanifagaki.pdf
- http://fightingthefight.org/uploads/1/3/0/7/130776110/8244a61e4e.pdf
- http://kristenshirts.com/uploads/1/3/0/6/130639138/7edf89efa97be.pdf
- http://yenisiyasetkulturu.com/uploads/1/3/0/2/130288402/a0ca0ea8bea.pdf
- http://www.yaayaavintage.com/uploads/1/3/1/0/131070072/7308282.pdf
- http://crystaldictionary.online/uploads/1/3/0/5/130589004/92047a56.pdf
- http://ecopowerelectric.net/uploads/1/3/0/7/130740116/130740116.html#airtel+digital+tv+recharge+monthly+plans
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004ae4.bin32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4AE4 | 16164 bytes |
font_01_sfnt_off000062c3.bin6cf8236914f0941e88b218207c3b7e85b0b144635fa96c6accfc1bb4d336d13e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x62C3 | 8248 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.