MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of the primary external links points to 'https://maypoin.ru/123?utm_term=categorias+gramaticales+formales', which is likely part of a malicious link farm. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-10044376-0', indicating a phishing or trojanized document. The ML classifier also strongly flagged this PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/123?utm_term=categorias+gramaticales+formales
- https://cdn-cms.f-static.net/uploads/4386605/normal_5fe6d24919131.pdf
- https://natesikapepik.weebly.com/uploads/1/3/4/7/134750077/1792155.pdf
- https://favimorujupufu.weebly.com/uploads/1/3/2/7/132710565/ccd148492.pdf
- https://bewarovawizijus.weebly.com/uploads/1/3/4/4/134454629/572b3.pdf
- https://mupezoki.weebly.com/uploads/1/3/0/7/130739180/9861343.pdf
- https://funujitumim.weebly.com/uploads/1/3/5/3/135347265/donenofoxukazar-kurizarok-mapibajawafab-pojuxireki.pdf
- https://geziduvugizi.weebly.com/uploads/1/3/4/8/134862990/badulebifa-bagulaga-gonivejibetanox-pakab.pdf
- https://ronawidafaleso.weebly.com/uploads/1/3/4/5/134504313/xomibid.pdf
- https://dugitesabisaxo.weebly.com/uploads/1/3/4/3/134392589/ravoxizi_kifipokanojef_datejogetipaz_zisinefarunu.pdf
- https://cdn-cms.f-static.net/uploads/4417329/normal_601bb5da05af6.pdf
- https://papekukikaduli.weebly.com/uploads/1/3/4/3/134361343/6c4e0.pdf
- https://xokojitijuxup.weebly.com/uploads/1/3/4/3/134362284/1047233.pdf
- https://sokexuwog.weebly.com/uploads/1/3/4/3/134351495/b2baeabd6eb66.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/10087c09-bc89-41dc-a990-76da7cd0e8af/how_to_fix_keyboard_not_working_on_dell_laptop.pdf
- https://uploads.strikinglycdn.com/files/99e81846-99c9-4085-91a4-c70004b4cd54/amigo_brothers_summary_plus_two_english.pdf
- http://nitezug.pbworks.com/f/41452204772.pdf
- https://uploads.strikinglycdn.com/files/3bdf6b14-206f-4cdc-b920-209bfde76eae/20423563009.pdf
- http://jebusolole.pbworks.com/f/58367595719.pdf
- https://uploads.strikinglycdn.com/files/457d6af0-2f91-4aa1-a691-dd99dcccc248/movie_screenplays_for_sale.pdf
- https://uploads.strikinglycdn.com/files/2709ddda-23af-42e7-9d2a-8624fb13d29c/78182111099.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000186ff.binec0b724e20e7191cc7513de7c87663b89e960cf3316e75eef9f8990cccf0db6e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x186FF | 5104 bytes |
font_01_sfnt_off00019848.bin70477d56b8d24d121c0b2dc0ff260e17073127cde40c991603d06c2073f2e93f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19848 | 13732 bytes |
font_02_sfnt_off0001c4ef.bin541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1C4EF | 16204 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.