MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=report+builder+datediff+month PDF link annotation
- http://izzzaaa.space/biophysique_coursmbm0x.pdfIn PDF document text
- http://spacexfoundation.net/que_se_entiende_por_contabilidad_de_costoscgro5.pdfIn PDF document text
- https://cdn.sqhk.co/zamodozitip/CxgfMib/poker_tournament_manager_software_mac.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446490/normal_5fde8e5da1022.pdfIn PDF document text
- http://pushbiz.fun/k5_learning_reading_comprehension_worksheets_third_gradeiips5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420743/normal_6039f7593ad6c.pdfIn PDF document text
- https://cdn.sqhk.co/zosiwikiw/MgVjfL9/car_manufacturer_tycoon_mod_apk_2._4._3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454290/normal_5fffa172285e0.pdfIn PDF document text
- https://cdn.sqhk.co/letiludixo/gijibjf/97604696249.pdfIn PDF document text
- http://feedbacrnz.space/53749518233a3ski.pdfIn PDF document text
- https://cdn.sqhk.co/dejuroli/haNVher/92650257195.pdfIn PDF document text
- https://cdn.sqhk.co/vanewano/QjghdWt/hoops_pinball_machine_for_sale_uk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413475/normal_603ea41839f65.pdfIn PDF document text
- http://gugezebaz.mygamesonline.org/catechism_of_the_catholic_church_second_edition.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490519/normal_600f8dd7d2692.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://89d9876f-4e47-4433-ab5b-8da47ae3ae5c.filesusr.com/ugd/37c326_df5d3a8cfe6941248e0376acb0f59417.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/40679b3b-d66b-4766-883e-d2d2bfb6ecb7/wenatusikatenetogenofukov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a442261-8672-4731-8bee-ab36d7cdae48/10_dias_festivos_en_mexico.pdfIn PDF document text
- https://e942959e-95af-4115-ab05-a6e38533eaad.filesusr.com/ugd/66f7a0_37f3afee863b42f79ff62b9fad86e7b9.pdf?index=trueIn PDF document text
- https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_667fea96395b4c1f903da5e64cdc3123.pdf?index=trueIn PDF document text
- https://667abc8f-92ca-45d9-bc9d-789c80a68858.filesusr.com/ugd/dcd78f_7027aa10f81540079a97de0f47b1928c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e0ddcdae-5632-4b78-8655-29b0732d3756/easy_lunch_ideas_for_fussy_eaters.pdfIn PDF document text
- https://c1bbde11-5cda-4f7c-8b74-b2fe90b484f5.filesusr.com/ugd/1c8c6c_808ea040bc464396b105a52b1ec7bd9b.pdf?index=trueIn PDF document text
- http://xurosuforudev.atwebpages.com/how_accurate_is_a_finger_pulse_oximeter.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e2b1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE2B1 | 5248 bytes |
SHA-256: e44323a050a35248dac818ec8982bb1d220d83be3aab96f1785c06fb4d523b1a |
|||
font_01_sfnt_off0000f45d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF45D | 10808 bytes |
SHA-256: c74de890399bbef985aefa9197bab3c9c20b64cf35ab329fb4ea8f8a10b3def5 |
|||
font_02_sfnt_off0001195c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1195C | 16076 bytes |
SHA-256: ceb30e69b2a1d6501fe8904d8a8466471eaa529f0958da5583c6585f97c9fab1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.