MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm. It contains numerous external links, many hosted on disposable domains, suggesting an attempt to direct users to potentially malicious websites. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic indicate a phishing or malware distribution vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://coretry.ru/pbw?utm_term=percy+jackson+%2526+the+olympians+the+lightning+thief+hollywood+hindi+dubbed+movie+download PDF link annotation
- https://nokifijipuf.weebly.com/uploads/1/3/4/3/134305843/d204628.pdfIn PDF document text
- https://defusisiz.weebly.com/uploads/1/3/4/5/134599350/nobosotunanipu-vosafudisa-rogotukuf-zegamuf.pdfIn PDF document text
- https://sumomaduge.weebly.com/uploads/1/3/4/8/134884200/7c028c68.pdfIn PDF document text
- https://sivowudu.weebly.com/uploads/1/3/7/5/137513174/fijawok_fapunopip_xekaromewo.pdfIn PDF document text
- https://vipekisurular.weebly.com/uploads/1/3/1/4/131453387/3973351.pdfIn PDF document text
- https://wosabawa.weebly.com/uploads/1/3/5/3/135390578/846218.pdfIn PDF document text
- https://xebokedobonu.weebly.com/uploads/1/3/4/7/134719403/kigan.pdfIn PDF document text
- https://nawobelif.weebly.com/uploads/1/3/5/3/135307193/vajupo.pdfIn PDF document text
- https://xebokedobonu.weebly.com/uploads/1/3/4/7/134719403/19ec97e6ccee8b5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/ded7a99e-2f88-4a44-a693-fae7205c9ca6/lasko_ceramic_tower_heater_with_remote_control_manual.pdfIn PDF document text
- http://pusavivo.pbworks.com/w/file/fetch/144456735/macario_juan_rulfo_resea.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/218a4210-cf07-46db-a739-7126d7cbd7ce/75326903719.pdfIn PDF document text
- http://zewalar.pbworks.com/w/file/fetch/144471882/bullet_force_unity_webgl_unblocked.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31e47873-d9f0-4f2e-8815-cd83f240b8ec/sel_351r_manual.pdfIn PDF document text
- http://zufumegi.pbworks.com/w/file/fetch/144422358/jufojekibitox.pdfIn PDF document text
- http://zelovoguvunu.pbworks.com/f/61056543081.pdfIn PDF document text
- http://jebusolole.pbworks.com/w/file/fetch/144523701/todenogukuxubug.pdfIn PDF document text
- http://tijigika.pbworks.com/f/does_a_residents_association_need_to_be_registered.pdfIn PDF document text
- http://kelivesas.pbworks.com/f/51919358450.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010ecc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ECC | 6296 bytes |
SHA-256: 0cb46ecd5c182fac6bc9b98edfeab820ec5d5b3347d0ff317eff30bfc0287af2 |
|||
font_01_sfnt_off00012488.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12488 | 5004 bytes |
SHA-256: 5235547b5fc70c5e86795270d9c33b329ae1599f6774222301bd95e420389459 |
|||
font_02_sfnt_off000135a9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x135A9 | 22544 bytes |
SHA-256: 721190e148ca0fd7d2ef0b9bd97fa0855a049fd07e37298a985b4dcf2c18a514 |
|||
font_03_sfnt_off00016e18.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16E18 | 16396 bytes |
SHA-256: 51213217ede66b7193084c2f243d5028a364055071cc5d86fc5528dc7401671d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.