MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a large number of external links, many of which point to disposable domains and are likely part of a link farm. The embedded URL 'https://pelibifir.ru/strik?utm_term=which+pool+heater+is+best' suggests a lure to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or trojan-like behavior.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=which+pool+heater+is+best PDF link annotation
- https://patinijogu.weebly.com/uploads/1/3/4/8/134854147/nexatin-xezonoza-madajidot.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411922/normal_60237301a2572.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422368/normal_604e3df216b82.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454811/normal_5fdc68f9a1d7c.pdfIn PDF document text
- http://komakukamuduwi.iblogger.org/sesofozawumiwowok.pdfIn PDF document text
- https://jiwonilasipa.weebly.com/uploads/1/3/4/3/134313366/9309506.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482848/normal_5ff5c1ae9e7bc.pdfIn PDF document text
- https://sanuvexugivi.weebly.com/uploads/1/3/1/6/131606490/sovevo.pdfIn PDF document text
- https://ranezilipevag.weebly.com/uploads/1/3/5/3/135392607/kumofijodide-rorosibos-toroni.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368950/normal_60432ef77c756.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4474222/normal_602f59fbed6ce.pdfIn PDF document text
- http://gonadawu.22web.org/84928821255.pdfIn PDF document text
- https://tepidupelagoxu.weebly.com/uploads/1/3/4/4/134472529/8ad581fe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383688/normal_605003547558e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383698/normal_604b612437a62.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://332892e0-6a2b-40ad-946e-e7c92c61c867.filesusr.com/ugd/3e5d97_793487de2bde43638a5804b64b381ef7.pdf?index=trueIn PDF document text
- https://b1d4f555-1eac-4d61-aa83-27206cf3ee4b.filesusr.com/ugd/1706f5_1958175f241049ddb66edc83c6f42351.pdf?index=trueIn PDF document text
- http://pejonoma.epizy.com/aquella_orilla_nuestra_descargar.pdfIn PDF document text
- http://wujidazigobad.rf.gd/zesunubixixupijifeseveju.pdfIn PDF document text
- https://aaf8962b-2ea5-4403-bfea-7c32f2b3f77e.filesusr.com/ugd/8f3a65_a91b582a8dc84609bfa828ada4f5b914.pdf?index=trueIn PDF document text
- https://cff07a16-13b2-455b-8a78-148a75b158b4.filesusr.com/ugd/cda0c7_99162e25935c43e38b88f841e03bfcbe.pdf?index=trueIn PDF document text
- https://f1ddcea9-c323-452c-a4d3-aaefec61e50a.filesusr.com/ugd/defd8a_313f41e3045a4cf1a126f6c6f788a8f7.pdf?index=trueIn PDF document text
- https://72dfff08-f6cb-4f5d-aaac-ebe71175d6a6.filesusr.com/ugd/c268f7_cef84c489f034cec8c11824d9a520bf1.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000da6f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA6F | 5176 bytes |
SHA-256: 23c7ba531dc06edd4d16f82c19aa19bd8f58f771679d0af4009b2924a80ea362 |
|||
font_01_sfnt_off0000ec11.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC11 | 10176 bytes |
SHA-256: 42b7a0f27cdb8557934490e1d0da3d6a62243eb4ed7882d35df3277307318264 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.