MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a large number of external links, many pointing to disposable hosting, indicating a link farm designed to redirect users. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware delivery. The embedded URL `https://pelibifir.ru/strik?utm_term=how+to+cite+internet+sources+with+no+author` is a primary indicator of this malicious activity.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=how+to+cite+internet+sources+with+no+author PDF link annotation
- http://getchambre.xyz/conscious_discipline_book6g6e3.pdfIn PDF document text
- http://sallles.ru/what_is_delegation_in_nursing8w2aa.pdfIn PDF document text
- http://prod-fruit.space/lenovo_thinkpad_t430_review_ukb6cdj.pdfIn PDF document text
- http://hook-up.fun/zosana22kib.pdfIn PDF document text
- http://pikegupima.medianewsonline.com/brain_games_free_download.pdfIn PDF document text
- http://nafepuzemobir.sportsontheweb.net/84610548330.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://e028ba52-6c86-493e-86b7-fecf7cd1c3eb.filesusr.com/ugd/bcb9fd_8fdc0d50a81c4d78b4148268cbaf4b15.pdf?index=trueIn PDF document text
- https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_a28152ddaf924f8e8d303787a87aa816.pdf?index=trueIn PDF document text
- https://3c45aaf8-24f3-4cde-9773-cf44a0a970d3.filesusr.com/ugd/ae7d54_0c018c302eb548b7a56c49e2c84e104e.pdf?index=trueIn PDF document text
- https://dc5ca969-d333-4582-9879-b719aca70d73.filesusr.com/ugd/760c43_e3254d9c8f214f6c876f51026e13521e.pdf?index=trueIn PDF document text
- https://5fb3b2f4-e86d-4029-b823-ac5950ddf4c1.filesusr.com/ugd/c0aa49_895d7f5b1b6845758ee539e9f81a73d4.pdf?index=trueIn PDF document text
- https://17500468-634e-4f48-81ad-48a4a068d6fa.filesusr.com/ugd/dcac76_00e236a410684ac6ae28343f6a2375b4.pdf?index=trueIn PDF document text
- https://e5eb5b25-b33c-43e3-82d5-57ab1bf863d8.filesusr.com/ugd/b0c717_f86ab1b3345d451ebb2eebd9158823e3.pdf?index=trueIn PDF document text
- http://wonanikapudidak.atwebpages.com/libro_amigos_para_siempre.pdfIn PDF document text
- http://muliwavanebebo.onlinewebshop.net/list_of_root_words_in_english.pdfIn PDF document text
- https://s3.amazonaws.com/sonutopexaramuf/66875741463.pdfIn PDF document text
- https://s3.amazonaws.com/fomudebipefasu/51268068359.pdfIn PDF document text
- https://s3.amazonaws.com/sesijesule/bejimopixele.pdfIn PDF document text
- http://sasaxunofob.atwebpages.com/danumazifof.pdfIn PDF document text
- https://s3.amazonaws.com/fosalizuzu/lekugoz.pdfIn PDF document text
- https://41be308f-8a64-4dec-8b30-4937605be974.filesusr.com/ugd/f042fe_ffa40e7c3bb444d78f433e13f1121426.pdf?index=trueIn PDF document text
- https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_fcca4d68864c4febbae026cac5a81251.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec94.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC94 | 4908 bytes |
SHA-256: c004e7ae1cf6cf3dd59a59a1291ec7cd09e2c39569c1e0c7b63f692d488234dc |
|||
font_01_sfnt_off0000fd4f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD4F | 11084 bytes |
SHA-256: 6f9babf5392c6dbda70bfef9d8a083d71930aa3c5b73d0122eaafdb393e580e3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.