MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan-like behavior. It contains a large number of external links, suggesting it functions as a link farm. The primary URL, https://vilenefex.ru/123?utm_term=mtb+chain+guide+bb+mount, is likely part of this malicious infrastructure. No scripts were extracted, but the PDF structure itself is used to host these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/123?utm_term=mtb+chain+guide+bb+mount PDF link annotation
- https://xosizinunebazen.weebly.com/uploads/1/3/4/0/134017923/4373643.pdfIn PDF document text
- https://sovakevu.weebly.com/uploads/1/3/4/3/134341498/tilularigafigete.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462341/normal_6029ac1738798.pdfIn PDF document text
- https://dapunilak.weebly.com/uploads/1/3/4/5/134506399/9764459.pdfIn PDF document text
- https://tadurefejixuset.weebly.com/uploads/1/3/4/4/134498676/namuguzezoparu.pdfIn PDF document text
- https://juzunuxav.weebly.com/uploads/1/3/4/3/134316531/vemavavanasuj.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4450240/normal_5ff5b8650500b.pdfIn PDF document text
- https://zusifupovososix.weebly.com/uploads/1/3/2/6/132680896/ab4de92ac25e707.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484097/normal_6056a8569c427.pdfIn PDF document text
- https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/zamivelinajavel-wololoba-nujaxuke.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469643/normal_60bcabf917f2c.pdfIn PDF document text
- https://memozarukun.weebly.com/uploads/1/3/4/3/134378051/xudigivifedokuwa.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://vojewukejiwu.pbworks.com/w/file/fetch/145019244/22990436045.pdfIn PDF document text
- http://lipemuv.pbworks.com/f/two_step_equations_addition_and_subtraction_worksheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2a60aafc-f8be-4df0-85a6-6ab54b7a2a67/41154444519.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1ea9c59a-f81f-42b9-ba80-1594987e5b40/67456081586.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b7c1a65-57fb-48b9-8635-898b69f22e57/43471437351.pdfIn PDF document text
- http://tuvovazuvezo.pbworks.com/w/file/fetch/144631488/2007_suzuki_gsxr_600_repair_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/552d4d98-68b7-45e3-9065-ee3ac2b23625/vowosenadazumufewosibo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99611be2-6189-4ada-a01d-0494fffd5d83/slideshow_video_template_premiere_pro_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cac1d6d6-c5ea-4cb3-9773-c8c73a6c7982/ante-nicene_fathers_volume_10.pdfIn PDF document text
- http://xoxafepapesu.pbworks.com/w/file/fetch/144421131/dragon_ball_z_budokai_tenkaichi_3_ps2_vs_wii.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8690a23-3051-47a8-afb6-6b4024a07940/mental_toughness_quotes.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dffa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFFA | 5192 bytes |
SHA-256: c24be0628293f60284cac71555e589372343efc961f036c6849ab2e4d97f344d |
|||
font_01_sfnt_off0000f18b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF18B | 11188 bytes |
SHA-256: ec9aa698e7648d195541da09b8516fdc2dd59e6a4551855909b8297159a75a68 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.