MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/123?utm_term=ffxiv+eureka+relic+weapon+guide PDF link annotation
- https://cdn-cms.f-static.net/uploads/4420745/normal_6035c5e55452c.pdfIn PDF document text
- https://molesomux.weebly.com/uploads/1/3/2/6/132681378/49b9f.pdfIn PDF document text
- https://faturigazed.weebly.com/uploads/1/3/4/8/134859690/susogetegiwaruvowodu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450256/normal_6063da57f34e0.pdfIn PDF document text
- https://tezonebikinigax.weebly.com/uploads/1/3/1/6/131637870/temuj.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4461746/normal_6006b6cecde2a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451376/normal_604adc343bda1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388282/normal_6042d10235ccd.pdfIn PDF document text
- https://faneboluti.weebly.com/uploads/1/3/4/4/134464249/kekuzisedomot.pdfIn PDF document text
- https://lenusasifelodu.weebly.com/uploads/1/3/4/3/134350773/2668125.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4406806/normal_603748003163b.pdfIn PDF document text
- https://moxuwurenawa.weebly.com/uploads/1/3/0/8/130874588/d65a88bfdfd88.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366003/normal_6009cb43296d6.pdfIn PDF document text
- https://taxubixud.weebly.com/uploads/1/3/4/7/134760406/b6e1362d5485cf9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4462362/normal_5fffbc5ac9fa8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4496148/normal_60205258e8eda.pdfIn PDF document text
- https://leduxuma.weebly.com/uploads/1/3/2/8/132814900/8006794.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453334/normal_603231694d0a6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4443341/normal_5fc78db3758f9.pdfIn PDF document text
- https://zukedobawalot.weebly.com/uploads/1/3/4/5/134526307/5053925.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/18f7d553-c412-4f86-8883-21085338ce49/garimafexetowobulitamovuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/143fa871-1627-4355-81c1-eda0474c5cf5/jevoze.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/49251e0b-d428-48ba-97bb-bd24e827ce6b/82648775364.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fc7ef5e-3379-41be-8518-f6b8143259d4/how_to_become_a_surgical_tech_salary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02b15926-6f34-42d5-a298-a7f2ef50ac0d/20579616597.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011b4c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B4C | 9188 bytes |
SHA-256: 9d9a38f99514ef324568929f0d060b1236092080d43877844e8d6bc6050bb8df |
|||
font_01_sfnt_off00013a1c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13A1C | 5384 bytes |
SHA-256: 3d66e9250371965ab0e10a1aa46466c8b26e23889e3bc2af5cfe825e230b6fe5 |
|||
font_02_sfnt_off00014c9d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14C9D | 12064 bytes |
SHA-256: 12a43d1d78c3fcfaf6c833a35a94cf3dc3d905bb7872639a14cc2750ad06dd0b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.