MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are likely part of a link farm designed to manipulate search engine results. One of the primary URLs, 'https://seumenha.ru/award?keyword=vejiga+neurog%25C3%25A9nica+en+ni%25C3%25B1os+pdf', is flagged as suspicious. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0', indicating a phishing or trojanized document.
Machine Learning
- Nyx PDF Classifier malicious score 0.8336
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/award?keyword=vejiga+neurog%25C3%25A9nica+en+ni%25C3%25B1os+pdf PDF link annotation
- https://cdn.sqhk.co/wakewafo/hyzOhgI/space_per_chicks.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387226/normal_604894ce45ab9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383801/normal_603e98e244b37.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4406223/normal_5fd628d05e75f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446500/normal_5ffbd95202e35.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464315/normal_5ff7cf5cbb470.pdfIn PDF document text
- https://cdn.sqhk.co/wabasenenem/bJR2EiU/29031317823.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402718/normal_60546629dfb39.pdfIn PDF document text
- https://cdn.sqhk.co/gogojelawov/ghexPYz/kiwimagamenepopuvop.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6c424fae-a942-4e5a-b818-e87973fca3ed/why_we_need_function_pointer_in_c.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e25476c-3de1-4bb0-b0bc-a59251cc89a3/pujalofuwa.pdfIn PDF document text
- https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_88f040717de1452b9b5eccf7b60bc34d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/baf104fb-d22c-4b91-9b1e-a0af5e64a443/petsafe_wireless_pet_containment_system_pif-300_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc7eea17-8f69-4dc6-af1e-ffc01fafe223/87323626079.pdfIn PDF document text
- https://aed0ee3a-d217-4696-a563-de9ff15d6c37.filesusr.com/ugd/f80e3f_0a3ef9b664b941f5950a916ac6517514.pdf?index=trueIn PDF document text
- https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_1b51d2b7209c4b5ea661731fdee64e42.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3da039e9-1282-41ba-b390-a43917637a19/41076447617.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec61.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC61 | 5684 bytes |
SHA-256: e3afc9be336d974c81fac36cc38c3df06f844838acf96040f6f0e2f2ff202078 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.