MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This technique is commonly used in phishing campaigns to distribute malicious content or redirect users to scam websites. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. No scripts were extracted from this sample.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://mkrbd.net/uploads/1/3/0/3/130323733/6371427.pdf
- http://msaecr19.com/uploads/1/3/0/6/130621127/tusut-wedututokolame.pdf
- http://weluckyfew.com/uploads/1/3/0/7/130740252/c68a1.pdf
- http://milegion-legacyrun.org/uploads/1/3/0/2/130272432/9403743.pdf
- http://djharperoldschool.com/uploads/1/3/0/5/130544898/9088896.pdf
- http://seattlebarterexchange.com/uploads/1/3/0/4/130475877/ebc8df0.pdf
- http://atlasaviation.org/uploads/1/3/0/2/130287295/dezekavevim-gofofolinu-lafenuxonixi.pdf
- http://mty.news/uploads/1/3/0/5/130539255/xisiwagogub.pdf
- http://thetri-fectagroup.com/uploads/1/3/0/5/130551091/fepatejutabi.pdf
- http://alphagroupm.com/uploads/1/3/0/6/130621853/8767050.pdf
- http://sahajmeditation.us/uploads/1/3/0/4/130478882/c750b0.pdf
- http://deltaixsecurity.com/uploads/1/3/0/3/130313368/rokaxuzi_kisefi.pdf
- http://proarbtreeservices.com.au/uploads/1/3/0/4/130476145/xibevi-kofefin-gukoxeperejib.pdf
- http://pursuitofhappiness.live/uploads/1/3/0/2/130271085/92797a4.pdf
- http://simscambodia.com/uploads/1/3/0/6/130639553/kizosifozuz.pdf
- http://ayyamouvement.org/uploads/1/3/0/6/130639946/8f507d51b0d4cef.pdf
- http://197cedarrock.com/uploads/1/3/0/6/130639856/fc1fe3bde2.pdf
- http://www.christinahankinsart.com/uploads/1/3/0/2/130272355/7730258.pdf
- http://flowironsolutions.com/uploads/1/3/0/6/130639030/bimosa-xijasanavuselu-nonox.pdf
- http://xrdsfaith.com/uploads/1/3/0/2/130289774/dabujasezekafen.pdf
- http://glebl.bpmtc.com/uploads/1/3/0/4/130476407/130476407.html#gta+5+money+cheat+xbox+1+story+mode
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000272c.bin3334b850de47179f2ad7d2db165c1dbb2d31dabcccbe14ad1a63fe958802e488 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x272C | 9308 bytes |
font_01_sfnt_off0000e026.bin45c39c4315a5d00962143d4102937301eb2649728d6de39b959633cfc30365c3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE026 | 16144 bytes |
font_02_sfnt_off0000f4b6.bin83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4B6 | 1708 bytes |
font_03_sfnt_off0000fcbc.binadeff56123876f60748ea9b144a42fb68c4517528ca984778104f1eafcf97c21 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFCBC | 2648 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.