MALICIOUS
226
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of external links, many of which point to disposable hosting, indicating a link farm designed to direct users to potentially malicious sites. The 'SE_ADVANCE_FEE_SCAM_LURE' heuristic strongly suggests the document's content is intended to deceive users into believing they will receive a prize or parcel, a common tactic in advance-fee fraud. The ML classifier and ClamAV detection further support the malicious nature of this file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/123?utm_term=klairs+midnight+blue+calming+sheet+mask+cosdna
- http://indohealth365.online/95453874227vg2b3.pdf
- https://gojafone.weebly.com/uploads/1/3/4/8/134891791/fcd7a22c4c6cbe.pdf
- http://philonio.online/how_to_refill_ink_cartridges_hp_302wug7y.pdf
- https://zudejuzire.weebly.com/uploads/1/3/2/6/132681250/levedaju.pdf
- http://yesnutural.space/atm_in_computer_networkwjwpv.pdf
- http://dekagexagupeje.iblogger.org/division_worksheets_grade_3_common_core.pdf
- http://idealicait.website/25759592514oz7l1.pdf
- https://xonuvalax.weebly.com/uploads/1/3/1/4/131437330/tiguxexodus.pdf
- https://zopatiselinijil.weebly.com/uploads/1/3/4/7/134758238/mufezinolewegova.pdf
- https://xomilazarega.weebly.com/uploads/1/3/4/5/134511507/wijajamuxube_kevif_xudixojasujutu_mobigakokafeki.pdf
- http://nuloriwilorij.scienceontheweb.net/welawidab.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://suvalomimo.atwebpages.com/el_caballo_de_troya_audiolibro_descargar.pdf
- https://cd489911-dc6d-4439-b408-84622343fb93.filesusr.com/ugd/d8e941_e3e5e3e6c2254c9e87cb91a809a6fe7a.pdf?index=true
- http://futakanawus.onlinewebshop.net/how_much_does_a_co_make_in_texas.pdf
- https://uploads.strikinglycdn.com/files/ca518060-e2a5-404c-9a62-f674b96036bf/can_you_use_fender_fuse_on_ipad.pdf
- http://riberudedanute.epizy.com/suzuki_violin_school_book_1.pdf
- https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_7043ae573b384bf6a6ea0db785a72c01.pdf?index=true
- https://uploads.strikinglycdn.com/files/aa1a4cc4-f3e0-42f5-b109-9146945ba66d/cyberpunk_2077_johnny_silverhand_gun_mods.pdf
- https://uploads.strikinglycdn.com/files/c11a64d1-37c1-4ee4-8cca-7df19c61f055/lakshmi_ashtothram_in_telugu_mp3_free_download.pdf
- https://55f5e71c-5f54-469f-9449-301c43944234.filesusr.com/ugd/bbdb65_77075f42e1dd411aa71dc0bfdaf8dee1.pdf?index=true
- https://uploads.strikinglycdn.com/files/e0d7661f-6157-4e99-bed5-7ef25ffbb51b/94224397167.pdf
- https://1b2c4efd-c8eb-4b04-b26f-b9154d704720.filesusr.com/ugd/d3758e_4c475dcadf0243ea8bd1ea84fca5f861.pdf?index=true
- https://9a89a7da-ede3-42eb-a537-7416be21eb2d.filesusr.com/ugd/aaaf79_fe6292bed2634352ab2c04cce28f8e94.pdf?index=true
- http://dalapodomunok.epizy.com/what_is_the_gutenberg_bible_worth.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012b07.bin4c5b51e872c8d3b59dd502c319bc9f72f935ada72d78f78a56fd3290b81dd403 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12B07 | 5524 bytes |
font_01_sfnt_off00013da0.bin50123af60ef611bcb61c3fb8b740e2464b25ecaf4615e048f7a4e26302da2009 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13DA0 | 11140 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.