MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/123?utm_term=macromolecules+lab+report+introduction PDF link annotation
- https://kogatakuzomaw.weebly.com/uploads/1/3/4/4/134444425/a7713bca129c97a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448100/normal_603fd1b3609eb.pdfIn PDF document text
- https://gitapobukelagij.weebly.com/uploads/1/3/4/2/134266265/zexadizafavo_wewupipojok_lelawaleja.pdfIn PDF document text
- https://bepixumute.weebly.com/uploads/1/3/5/3/135302933/8775049.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371553/normal_604cdca6f278b.pdfIn PDF document text
- https://xiwapidijiz.weebly.com/uploads/1/3/4/5/134511693/wesajezoxujenutexan.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413467/normal_5fd76b2d77420.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393506/normal_6029a28470540.pdfIn PDF document text
- https://sofirutowik.weebly.com/uploads/1/3/1/3/131381411/71b4b2.pdfIn PDF document text
- https://laxonetamaj.weebly.com/uploads/1/3/4/0/134096763/3398009.pdfIn PDF document text
- https://nuzopotox.weebly.com/uploads/1/3/4/4/134497293/131c62adf32529.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://giribuv.pbworks.com/f/89864967324.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9d83305-40a2-4088-8131-191dd5bc9cdf/lawosimajefefuwuxosot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da08ab0c-3014-4fd4-9fa0-3ece307e9099/dovopaz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f52a9b2c-85db-4eec-b5f2-97db48bad8e9/wamomewololizavukesokek.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45481427-e0b7-41f2-b168-a162ed9636a9/sususulom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f7fff972-8238-49b9-ad3e-6783cb06dab0/adventures_of_huckleberry_finn_sparknotes_chapter_14.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da753c86-90b9-42b2-9618-6478600e5914/how_long_to_smoke_ribs_on_a_electric_smoker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d17fa2e1-2e99-490e-8a32-7558eb6edbf5/which_word_best_describes_orbiting_around_the_sun.pdfIn PDF document text
- http://rixepal.pbworks.com/f/2451755548.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1fb8ba0a-8cfd-4af1-880a-70f7e96544e3/klh_subwoofer_asw10-120.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e555.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE555 | 5364 bytes |
SHA-256: 1121c0b33d074f95815bbb20af68632e4f0dd13bf8a09cf46857df868cc91bd4 |
|||
font_01_sfnt_off0000f77e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF77E | 11064 bytes |
SHA-256: 8a07b4be5a2f094fe1a564bfc8e2cf7064fbc79723e1058927d6dd15ce1d2bf9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.