MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, many of which are hosted on disposable domains and utilize UTM parameters, suggesting a link farm designed to redirect users to potentially harmful content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically flags this behavior, indicating the document's purpose is likely to distribute malware or conduct phishing attacks by directing users to external sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=digitech+jmsxt+jamman+solo+xt+review PDF link annotation
- https://cdn.sqhk.co/pugepavofu/ibbdieT/covet_fashion_dress_up_game_mod_apk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383917/normal_603ad0700bf75.pdfIn PDF document text
- http://zanartcc.net/2033078253h0sg2.pdfIn PDF document text
- http://sweetmeet.online/kowagilejn8xq.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4428078/normal_603b2d51a40f9.pdfIn PDF document text
- http://damvglaz1.xyz/lopobubusasezetbum24.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454054/normal_5fcf06a466423.pdfIn PDF document text
- http://pitushok.fun/xiwafigitosonebepezola3cpv.pdfIn PDF document text
- https://cdn.sqhk.co/xenotami/G8hcugc/false_positive_covid_test_email.pdfIn PDF document text
- http://filfex.ru/nadovapulopalisemu4lkk3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4465907/normal_60007b7ea27d4.pdfIn PDF document text
- https://cdn.sqhk.co/lojosewude/jjmibhb/indoor_rowing_competition_2019_uk.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413567/normal_5fe53046352a3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3aeab7b8-4070-4f27-9103-041bc8bb2135/34046654000.pdfIn PDF document text
- https://b9e1b105-38e0-4bbf-baad-90de1e2021e1.filesusr.com/ugd/432b07_43a1252bc864442e85c4176080610a81.pdf?index=trueIn PDF document text
- https://0ea28b16-58c2-472d-b6be-3e97fe9b7bb6.filesusr.com/ugd/696b8a_70dd382f54d6440c86a1e7dbd1dd8152.pdf?index=trueIn PDF document text
- https://7a1f2a0d-094a-4466-88af-72a4af93b9fa.filesusr.com/ugd/22739b_fffdc95944cc4823be4d1fed8b886e52.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a5992565-6696-439c-90a5-a8613874dd9a/94708809663.pdfIn PDF document text
- https://13a7c488-548c-4b48-b567-d2b0b9a3e1de.filesusr.com/ugd/85d67f_857c71b4bfcf408fb1d4d4a317c0b7e9.pdf?index=trueIn PDF document text
- https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_25f7f582915c4be4937d0eec0c4c2b32.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4057c6d9-e91f-4ac5-b883-95605e7a418f/matlab_plot_marker_color_rgb.pdfIn PDF document text
- https://a1d3e036-d9a1-4be1-9d2f-eedbb581cb22.filesusr.com/ugd/3ce946_d6ad131347a44707a9f7a6774a389948.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010301.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10301 | 5508 bytes |
SHA-256: c58433508b9e841426493c1bac8daee82cea315cbe59c2e0fd385a01757c24d0 |
|||
font_01_sfnt_off000115b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x115B5 | 10708 bytes |
SHA-256: 64ca1f58ce1188277545e2908fb521350158571b21d127bbbeb6a7a164325be1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.