MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was flagged for containing a large number of external links, indicative of a link farm or SEO spam. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further suggests a phishing or malicious traffic generation intent. The embedded URLs are likely used to redirect users to malicious content or further phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wivufow.expresszaimdeneg.ru/uploads/2020/01/28/129cf8.pdf In PDF document text
- http://peshtolina.com/uploads/1/3/0/5/130540097/dadoritoju_reruwadig_tuledepalebi_juminesixatu.pdfIn PDF document text
- https://wuralijotiraw.weebly.com/uploads/1/3/0/6/130604605/fafaf-sewiziseta-rinipomaxa-jewazodebusip.pdfIn PDF document text
- https://benopivezoso.weebly.com/uploads/1/3/0/2/130270845/8f82bd.pdfIn PDF document text
- http://milledlogs.com/uploads/1/3/0/3/130379457/5122346.pdfIn PDF document text
- http://mossmusicnews.weebly.com/uploads/1/3/0/2/130289063/eeb107a8b8c.pdfIn PDF document text
- http://spb-shocker.ru/uploads/2020/01/27/maroj.pdfIn PDF document text
- http://theforagedfern.com/uploads/1/3/0/6/130621532/5043735.pdfIn PDF document text
- http://azzurrawebart.com/uploads/1/3/0/3/130379380/188696.pdfIn PDF document text
- http://mystreetstamp.com/uploads/1/3/0/2/130270921/satafe-zarubagugexik-vonuj-vuvigoxib.pdfIn PDF document text
- http://rochesterreadingtutor.com/uploads/1/3/0/3/130323750/kojagatomoxot.pdfIn PDF document text
- http://sikizij.mummys-gold.ru/uploads/2020/01/28/lapuropadave-zonutoxofi-welak-kesaxilamales.pdfIn PDF document text
- http://asiaoutdoors.com.vn/uploads/1/3/0/6/130604030/zumadibamawebop.pdfIn PDF document text
- http://rockthecatspa.net/uploads/1/3/0/4/130436171/761737.pdfIn PDF document text
- http://xuzun.keydoors.ru/uploads/2020/01/27/2a90d4.pdfIn PDF document text
- http://rivatracecouncil.org/uploads/1/3/0/2/130289475/waxonusibuxinexokig.pdfIn PDF document text
- http://rigipeketa.goods-trends.top/uploads/2020/01/29/999997.pdfIn PDF document text
- http://100womenwhocarensc.com/uploads/1/3/0/5/130546923/zonufawiveli-movenilafanasa-fefuver-xodowenezavix.pdfIn PDF document text
- http://tcsonline.net/uploads/1/3/0/5/130550970/130550970.html#numeracy+worksheets+for+kindergartenIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000177b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x177B | 7916 bytes |
SHA-256: a9545397efb350e71b701d9c01c942de7463401d86098ff2cf50f38d40d8410a |
|||
font_01_sfnt_off00007094.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7094 | 16204 bytes |
SHA-256: f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.