MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded links to external websites, identified as a link farm. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely related to phishing or traffic redirection. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, with 'britemoonmarketing.com' being a dominant host. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://britemoonmarketing.com/uploads/1/3/0/6/130604519/87adb60.pdf In PDF document text
- http://minibodegasdeconcepcion.com/uploads/1/3/0/5/130550824/6721794.pdfIn PDF document text
- http://73forms.com/uploads/1/3/0/5/130590208/2972548.pdfIn PDF document text
- http://bmcomput.com/uploads/1/3/0/7/130776603/jugisaralavo_zubuzusud.pdfIn PDF document text
- http://gnaftis.com/uploads/1/3/0/6/130603945/3574233.pdfIn PDF document text
- http://sfbaycomiccon.com/uploads/1/3/0/7/130776252/5063821.pdfIn PDF document text
- http://adeptwebsolutions.com.au/uploads/1/3/0/5/130590030/bizabajavegafomuneb.pdfIn PDF document text
- http://mutiny-cannabis.com/uploads/1/3/0/5/130542937/medetegapima.pdfIn PDF document text
- http://mylabeau.com/uploads/1/3/0/6/130604527/febokatosa_repofadup.pdfIn PDF document text
- http://neuropolisblog.com/uploads/1/3/0/8/130874516/xapikave.pdfIn PDF document text
- http://idealcleaning.org/uploads/1/3/0/5/130550928/kiduwod.pdfIn PDF document text
- http://soundkitsupply.com/uploads/1/3/0/6/130604521/2940982.pdfIn PDF document text
- http://cannacab420.com/uploads/1/3/0/4/130489437/012aeecf0c12.pdfIn PDF document text
- http://mikesrollingthndr.com/uploads/1/3/0/2/130274028/wuduwala-rivilesuvifuzu.pdfIn PDF document text
- http://myulrika.com/uploads/1/3/0/6/130603724/ribidoliri_tagulesoponubun_mimomogagukaw_gelirifuv.pdfIn PDF document text
- http://namiwashcounty.org/uploads/1/3/0/5/130539155/gigin.pdfIn PDF document text
- http://bullfrogimaging.com/uploads/1/3/0/7/130776619/ketakugum-fezenojuwewuj-vadakurezejuzir-vereniziv.pdfIn PDF document text
- http://nolancunningham.net/uploads/1/3/0/2/130287945/fixoditolokewiv_golekuzub.pdfIn PDF document text
- http://nwm4.club/uploads/1/3/0/6/130639903/rukilotuw.pdfIn PDF document text
- http://baomahuiyulechengguanfang.br3h.com/uploads/1/3/0/6/130639256/130639256.html#ethylene+acrylic+acid+copolymer+dispersionIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00002da4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2DA4 | 16260 bytes |
SHA-256: 2b57b2f7c8f3bc38d05bd7e1919dcd7d971d606ce90b2da6579e55cc4e86234a |
|||
font_01_sfnt_off000045ff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45FF | 8180 bytes |
SHA-256: 267e528d5b9fe9d3b8be84f7a4ac7af67d9f7dd829e153dd96afcf6fb145191f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.