MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file was flagged by multiple heuristics, including a critical alert for a link farm containing numerous external PDF links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or traffic redirection intent. The embedded URLs are likely part of a campaign to lure users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://sinaidetroitmedicalfoundation.com/uploads/1/3/0/6/130640019/mibosakexutata.pdf In PDF document text
- http://absolutely-coraldee.com/uploads/1/3/0/8/130814980/mupododemurani.pdfIn PDF document text
- http://libertyhallwriters.us/uploads/1/3/0/8/130874156/6893341.pdfIn PDF document text
- http://www.claritybartleet.com/uploads/1/3/0/5/130542822/3243120.pdfIn PDF document text
- http://rightwrite.net/uploads/1/3/0/2/130273740/d8b590.pdfIn PDF document text
- http://missveltriskindergarten.com/uploads/1/3/0/3/130379361/2e7f841db36.pdfIn PDF document text
- http://divinedwelling.org/uploads/1/3/0/6/130621264/sosegepebinuj_ravev_mafovabawotom.pdfIn PDF document text
- http://britanynavarretephotography.com/uploads/1/3/0/4/130436094/zotanaberebetu-japov.pdfIn PDF document text
- http://mssugarscloset.com/uploads/1/3/0/4/130435682/vimapakawunedo.pdfIn PDF document text
- http://hillsmixtape.co.uk/uploads/1/3/0/7/130739261/3fe5d8a25.pdfIn PDF document text
- http://jaynetoner.com/uploads/1/3/0/8/130873941/5496203.pdfIn PDF document text
- http://ulbsllc.com/uploads/1/3/0/2/130272853/sodesuximusip_luretonubexa.pdfIn PDF document text
- http://newbraunfelsmasonry.com/uploads/1/3/0/6/130640071/e1080a015a3c.pdfIn PDF document text
- http://www.hudu.life/uploads/1/3/0/5/130588499/9840ac8f65a54.pdfIn PDF document text
- http://professionallawncareandlandscapingservicesnm.online/uploads/1/3/0/5/130588333/2043457.pdfIn PDF document text
- http://adsl-63-204-18-13.benefitplans.org/uploads/1/3/0/2/130272496/130272496.html#alpha+1+and+beta+1+adrenergic+blockersIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000012af.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12AF | 9236 bytes |
SHA-256: 4c7afe07c8fef25741010cfd820d607a33f272b10527bc224bae65220a574e76 |
|||
font_01_sfnt_off0000a699.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xA699 | 2860 bytes |
SHA-256: 4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.