MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are related to software downloads, suggesting a link farm or phishing attempt. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URL points to a site offering 'clash of clans mod apk download', further supporting a lure for potentially unwanted or malicious software.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/pbw?utm_term=clash+of+clans+mod+apk+download+unlimited+everything+2021
- https://cdn-cms.f-static.net/uploads/4425515/normal_6027b31ba6ec3.pdf
- https://cdn-cms.f-static.net/uploads/4488566/normal_6021f99ee4fe9.pdf
- https://fizinizaboz.weebly.com/uploads/1/3/5/3/135304720/8553689.pdf
- https://cdn-cms.f-static.net/uploads/4377128/normal_60199ca9f0226.pdf
- https://cdn-cms.f-static.net/uploads/4530868/normal_5fd6790606eb9.pdf
- https://cdn-cms.f-static.net/uploads/4393637/normal_601f9ed21798e.pdf
- https://cdn-cms.f-static.net/uploads/4366668/normal_6023b94327de3.pdf
- https://cdn-cms.f-static.net/uploads/4501996/normal_604fbdb0acc93.pdf
- https://cdn-cms.f-static.net/uploads/4464055/normal_603f1fc68dc3e.pdf
- https://wokopapun.weebly.com/uploads/1/3/5/3/135388848/a2fc9f868cea58.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/71622125-6319-4f8f-8b46-35956d405607/pokemon_go_joystick_android_without_root.pdf
- https://uploads.strikinglycdn.com/files/de52fe3e-3efc-45ea-9603-7191032c2e16/43747950066.pdf
- https://uploads.strikinglycdn.com/files/184e157e-d7fa-402e-9384-1d5ea3bb9ce8/lawn_boy_mower_oil.pdf
- https://uploads.strikinglycdn.com/files/f9b63bd8-5428-4e86-9c9b-87f866e88816/having_difficult_conversations_training_canada.pdf
- https://uploads.strikinglycdn.com/files/ac3aa8e9-c94c-40fd-850e-cd3414c7496c/87850443519.pdf
- https://uploads.strikinglycdn.com/files/86ef7d07-50b4-4c1b-bd27-647ecaf13873/kreepy_krauly_marathon_parts_diagram.pdf
- https://uploads.strikinglycdn.com/files/562adbb3-1ab3-47c2-8c0c-fc9ed6231f01/unity_definition_english.pdf
- https://uploads.strikinglycdn.com/files/53886f71-1ceb-4adf-a8f3-17f3800e4eab/jojezusagulifino.pdf
- https://uploads.strikinglycdn.com/files/e3deb932-e449-4e59-abd7-5c041de5aa34/mental_status_exam_example_write_up.pdf
- https://uploads.strikinglycdn.com/files/0d8dc955-324c-42b1-8d2d-ef04c908f9bc/ielts_academic_writing_task_1_samples_with_answers_band_8.pdf
- https://uploads.strikinglycdn.com/files/9fd23ace-fe8a-4045-b814-56b07b3a37c8/bowflex_elite_cost.pdf
- https://uploads.strikinglycdn.com/files/62feb8d7-a82c-4a17-a45b-b1b0f912a853/84841838357.pdf
- https://uploads.strikinglycdn.com/files/f24c415d-6164-4cf4-9ad3-ffd2ca9506f2/2001_honda_civic_transmission_repair_cost.pdf
- https://uploads.strikinglycdn.com/files/270d368f-cbca-4693-a56f-c6c625228f3a/the_true_story_of_the_three_little_pigs_book_cover.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000120d0.bin6a5d7c691d45b36e326aee32f7deaba5abe19f6f3841a3cc8254b4b12eedd03b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120D0 | 6116 bytes |
font_01_sfnt_off0001359e.bin89654630349a7c8beeeb22e626f3bc9335db0c927b11579ffd62291e4dfec642 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1359E | 11300 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.