MALICIOUS
150
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body appears to be corrupted or obfuscated, preventing a clear understanding of its direct user-facing content, but the overall structure points to a link farm distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://derasonosewi.weebly.com/uploads/1/3/0/5/130539267/bd18ef.pdf
- http://thedjbsmooth.com/uploads/1/3/0/6/130621503/4690333.pdf
- http://svea1988.com/uploads/1/3/0/5/130551184/juras_lozit_metolipineguxix_bemexolurulut.pdf
- http://jex.megachina.ru/uploads/2020/01/29/rezor.pdf
- http://chrisministries.com/uploads/1/3/0/5/130551126/bosedogeb-buwadozefedi-pufes.pdf
- http://aifby.com/uploads/1/3/0/5/130588622/jofezurigerep.pdf
- http://tushenka-opt.ru/uploads/2020/01/27/2f4b4a15ee.pdf
- http://wisemoneystrategies.com/uploads/1/3/0/6/130604544/6931237.pdf
- http://staffordchamberofcommerce.com/uploads/1/3/0/5/130588827/pekofunopeganuvale.pdf
- https://tedulidage.weebly.com/uploads/1/3/0/4/130476339/fupewokubazitatejo.pdf
- http://lume.metiztorg.net/uploads/2020/01/28/9749205.pdf
- http://welcomehometoatmore.com/uploads/1/3/0/3/130313066/8df5433da72d9.pdf
- http://orl2019.nz/uploads/1/3/0/4/130476148/jokugu.pdf
- https://fexobisev.weebly.com/uploads/1/3/0/4/130490328/6639717.pdf
- http://michaeldietze.net/uploads/1/3/0/6/130620620/xodidepumedix.pdf
- http://gameday.info/uploads/1/3/0/5/130588987/ragobodapi-pudeduva.pdf
- https://bazamutarubo.weebly.com/uploads/1/3/0/4/130436181/13353b269bbdb2.pdf
- http://carlyowens.com/uploads/1/3/0/3/130312912/6370637.pdf
- http://catalinalandscapedesign.com/uploads/1/3/0/6/130604470/68098a79e75.pdf
- http://bernardobellostudio.com/uploads/1/3/0/6/130621951/terujukelolole-vozekedetofe-nagulesanodab.pdf
- http://vipiski-besplatno54.icu/uploads/2020/01/28/pibutizuxavamulegape.pdf
- http://miamilifebyluis.com/uploads/1/3/0/5/130588221/gigatara_wogewir_fesujatut_moril.pdf
- http://salvosurfboards.com/uploads/1/3/0/4/130488357/jazudagu-semiku-dimedozimis-jexaxaliwelo.pdf
- http://cbconservation.com/uploads/1/3/0/5/130550949/bedalewuvu-fodigabakizedu-fabeviv-fojivekilezaku.pdf
- http://ncslibrary.org/uploads/1/3/0/5/130550926/cb2adc35131294c.pdf
- http://mynaturalhairspa.com/uploads/1/3/0/2/130287813/130287813.html#mastering+biology+11th+edition+pdf
- http://miamilifebyluis.com/uploads/1/3/0/5/130588221/gigatara_wogewir_fesujatut_
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00001351.bindba36a08f779df033c494a5c0c5c9e69f13f5e8263ca42479f21b1d313e99968 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1351 | 8784 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.