MALICIOUS
120
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs pointing to external PDF files hosted on various domains. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to potentially malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malware distribution intent. The document body itself is heavily obfuscated and does not provide direct clues to the user-facing lure.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://fewasag.rurostelekom.ru/uploads/2020/01/28/9835964.pdf
- https://gakegobadesumes.weebly.com/uploads/1/3/0/3/130323612/wavokupete-loralazofekefo-dulelero-maretegemete.pdf
- http://sacredhearts.ca/uploads/1/3/0/6/130603882/9e792384.pdf
- http://mtrageserllc.com/uploads/1/3/0/5/130551718/1abba448577.pdf
- http://papejumike.meessays.info/uploads/2020/01/28/e2781ed.pdf
- http://alabamafanaticon.com/uploads/1/3/0/5/130545241/fifonasipama.pdf
- http://vsetoplivo.ru/uploads/2020/01/27/82f86bd3.pdf
- http://joeljimenezfashion.shop/uploads/1/3/0/2/130274256/ae73773d.pdf
- http://brainspaceclassroom.com/uploads/1/3/0/4/130488701/8986331.pdf
- http://silverspurcamp.com/uploads/1/3/0/5/130588288/fopitikuzakomi.pdf
- http://onestoptoolshop.shop/uploads/1/3/0/5/130544826/9803a.pdf
- http://treeplantinghouston.com/uploads/1/3/0/4/130483509/9ce5ffaf8bff.pdf
- http://susitixet.bp-bas.com/uploads/2020/01/28/ruwaravodiz.pdf
- http://pensacoin.com/uploads/1/3/0/2/130271031/pivarumila.pdf
- http://d-team.info/uploads/1/3/0/5/130539215/ecd1ee250.pdf
- http://soz.quantum-communication.com/uploads/2020/01/28/ditej.pdf
- http://zamapag.ecoopower.com/uploads/2020/01/27/pasijolodifura_vakilibafu.pdf
- http://chanisehurst.com/uploads/1/3/0/2/130288661/4943552.pdf
- http://mosap.fondgreenbros.ru/uploads/2020/01/28/ad84ef4e2f.pdf
- http://pita.to19.icu/uploads/2020/01/27/0bbe432bc.pdf
- http://gitu.lumiprint.ru/uploads/2020/01/28/vudopitafu.pdf
- http://12stonesmoldcleaning.com/uploads/1/3/0/5/130540869/73203e498619997.pdf
- http://vikokoz.karvan-group.com/uploads/2020/01/27/5994030.pdf
- http://benebusivu.infonetacademy.tech/uploads/2020/01/28/finamixo.pdf
- http://bejustalittlebetter.com/uploads/1/3/0/3/130379902/130379902.html#samsung+a50+4gb+ram+gsm+arena
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001886.bin21cd4380a4e43d65176cbe9cc88a64f38323e6d03072af0435cf434a17bf92b0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1886 | 8600 bytes |
font_01_sfnt_off00007231.bind907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7231 | 2616 bytes |
font_02_sfnt_off00007acc.binddc6c38a5929b263b215a5b0c7aa8b1a409f146866f06980111f9f21a6232bf4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7ACC | 16036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.