MALICIOUS
160
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a mass external link farm pointing to numerous PDF files, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates the document's purpose is to trick users with a fake lottery or prize notification, a common advance-fee fraud. The ClamAV detection further confirms its malicious nature. The embedded URLs are likely part of this scam, directing users to potentially harmful content.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://privasack.com/uploads/1/3/0/3/130323469/lowefenod_mejewetopajun.pdf
- http://momentumdanceandfit.com/uploads/1/3/0/6/130604568/8589367.pdf
- http://mail.keramaris.gr/uploads/1/3/0/8/130874635/2592986.pdf
- http://www.amysanchezbennett.com/uploads/1/3/0/3/130379314/faxab.pdf
- http://mta-sts.mail.slimacademy.at/uploads/1/3/0/5/130588943/23f50eaf3e4e043.pdf
- http://mikemooers.com/uploads/1/3/0/6/130639406/tuwonagorigonuze.pdf
- http://londonsalesagency.com/uploads/1/3/0/6/130605203/8135dd0a.pdf
- http://animators.directory/uploads/1/3/0/3/130323236/7810729.pdf
- http://lunchboxcafeny.com/uploads/1/3/0/4/130489157/193afbd561e.pdf
- http://livingthings.co/uploads/1/3/0/5/130544072/02c39.pdf
- http://www.kimbescorner.com/uploads/1/3/0/6/130603937/5008232.pdf
- http://morethanfood.net/uploads/1/3/0/5/130543020/feduvixifaxajow.pdf
- http://smithandbyford.net/uploads/1/3/0/2/130272506/c83ab.pdf
- http://thecontactlensinstitute.com/uploads/1/3/0/4/130476873/8679569.pdf
- http://thesecrettohealthyliving.com/uploads/1/3/0/5/130588515/gosedewejepiperefowu.pdf
- http://trkscamps101.club/uploads/1/3/0/6/130621437/54d1c6b5df1147.pdf
- http://cnichollswriting.com/uploads/1/3/0/6/130640183/ripawozowabovub_jadid_wamixafomirorib_vaxedim.pdf
- http://200jobs.com/uploads/1/3/0/5/130551765/nanolu_guvexomopak.pdf
- http://mta-sts.jackiedoesntknowcrap.com/uploads/1/3/0/5/130540211/2cd713bec01.pdf
- http://webmail.stemstil.nl/uploads/1/3/0/5/130540214/3675475.pdf
- http://nicolasintheoldmarket.com/uploads/1/3/0/7/130775251/devozu.pdf
- http://dwmfoundation.org/uploads/1/3/0/6/130603943/3937589.pdf
- http://mombligation.net/uploads/1/3/0/6/130620747/sinogut-nijevipovozebaz-sedukuvimo.pdf
- http://ripperwebsolutions.com/uploads/1/3/0/4/130491418/746fec61b5.pdf
- http://chaddock-family.rominastiebenphotography.com/uploads/1/3/0/6/130621481/130621481.html#agency+problem+theory+pdf
- http://mail.keram
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004c14.bin64fc5b987ea0610707a67d642e28fb4b49a25a1a52df15ef48f73570506e24ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C14 | 9412 bytes |
font_01_sfnt_off00011057.binb080e6aa9682ff87567a230b404ab00780bafcfd3ba11e3f536b788ca6e08ef5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11057 | 16060 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.