MALICIOUS
152
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious File
The PDF file contains a large number of embedded links to other PDF files, a technique commonly used in SEO poisoning and phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. The document body, though heavily obfuscated, mentions 'ACCA Examiner' and 'practice test', suggesting a lure to trick users into downloading malicious content disguised as study material.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 3
-
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://koolcompanies.com/uploads/1/3/0/3/130379415/duzaxafinezixepal.pdf In PDF document text
- http://palomarpools.com/uploads/1/3/0/6/130604516/wuvapex.pdfIn PDF document text
- http://luxoperon.com/uploads/1/3/0/6/130620843/sizika_siganapib.pdfIn PDF document text
- http://alaskasummerinstitute2020.com/uploads/1/3/0/7/130738506/fupusobodadepezufevo.pdfIn PDF document text
- http://nathanbarot.com/uploads/1/3/0/6/130620811/kasafijokemuvevo.pdfIn PDF document text
- http://howmuchtrip.com/uploads/1/3/0/5/130588575/71613169.pdfIn PDF document text
- http://mynarrativeofmusic.com/uploads/1/3/0/5/130550944/fikukefotomug_zavolaloxaf_wofugopavexux_nirufopakotopu.pdfIn PDF document text
- http://nubeginningfarm.com/uploads/1/3/0/7/130738546/2308427.pdfIn PDF document text
- http://notaryofnh.com/uploads/1/3/0/3/130379504/relufo.pdfIn PDF document text
- http://5thwoman.com/uploads/1/3/0/8/130874586/8aece2.pdfIn PDF document text
- http://njprint-wear.com/uploads/1/3/0/4/130483819/bapogir_kovowoxemonaw_nosoputopam.pdfIn PDF document text
- http://saloteflorist.com/uploads/1/3/0/4/130489123/4043580.pdfIn PDF document text
- http://stealthlaptops.com/uploads/1/3/0/2/130272902/raxapekeka_zuzenazaga_videxe.pdfIn PDF document text
- http://reefnine.com/uploads/1/3/0/6/130639042/wifebifere.pdfIn PDF document text
- http://1600charlestonregionalparkway.com/uploads/1/3/0/7/130740062/pigitak-zixofilasinav.pdfIn PDF document text
- http://jennyslist.net/uploads/1/3/0/5/130544086/7277869.pdfIn PDF document text
- http://wcd-qe6b02fu.mgh-r.ch/uploads/1/3/0/4/130478307/130478307.html#acca+f9+practice+testIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00004c00.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4C00 | 16036 bytes |
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
|||
font_01_sfnt_off0000635c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x635C | 8648 bytes |
SHA-256: 091a12868ea3ade81c3e16d9b484bb8e09699a40b6a8045227e2b3e8b632b251 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.