MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=1994+ford+mustang+service+manual+pdf PDF link annotation
- https://cdn.sqhk.co/lokabawopup/WQhahe9/idle_dungeon_village_tycoon_adventurer_villager.pdfIn PDF document text
- https://cdn.sqhk.co/wejuladuke/jc723ih/13224299838.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://168d2a81-f750-40c6-a653-3787650f980d.filesusr.com/ugd/3bcfef_e9b0a53f61824841acc33281262f6dbf.pdf?index=trueIn PDF document text
- https://c827806f-f9bf-4fd3-a4ce-e487c020fa79.filesusr.com/ugd/6fd45c_347117e780da4400b5cf748d3f80c266.pdf?index=trueIn PDF document text
- https://1eb42bdc-3da6-4b32-b75f-4382f1721f8e.filesusr.com/ugd/35474d_1d4b77e93566494aae2e314aecc3712f.pdf?index=trueIn PDF document text
- https://43a98339-0465-49d0-a416-8cef4780896f.filesusr.com/ugd/89258f_ed6d10d864b34b75b396f5df112cee37.pdf?index=trueIn PDF document text
- https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_b67516ff3a2b4c3d883d87661a14c4d0.pdf?index=trueIn PDF document text
- https://6e678f60-abc6-404c-883a-cd1729fdffee.filesusr.com/ugd/e4291f_3edec9e2ce22446389403a8fa084de1a.pdf?index=trueIn PDF document text
- https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_4b99ac5595c2478fab207637afaa563d.pdf?index=trueIn PDF document text
- https://c9254e9e-0e71-498a-8384-ab4c929b52b4.filesusr.com/ugd/0699ff_6cdf85740f3a49479c99920dabffd1aa.pdf?index=trueIn PDF document text
- http://bivojeda.atwebpages.com/my_samsung_tv_wont_turn_on_and_no_red_light.pdfIn PDF document text
- https://7f58a6d3-5723-489e-a2bd-17fd91e1ddd5.filesusr.com/ugd/655495_06f330404fbb4519a6ad05ab36bc1cf8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/774cede4-1817-470f-886b-952384d42641/argument_essay_topics_for_high_school.pdfIn PDF document text
- http://vejegaba.atwebpages.com/82168326613.pdfIn PDF document text
- https://df4002df-ed14-466c-b758-10ced248c840.filesusr.com/ugd/3b03e6_efb2e49da1fd416e9792563760fed99a.pdf?index=trueIn PDF document text
- https://e0a971b2-7104-4718-9e5f-4f17d768618f.filesusr.com/ugd/6d43b6_113a2c6a54e94fc8b311dbc3592d6a9d.pdf?index=trueIn PDF document text
- https://9d03b195-5c34-4993-8a23-519dd2bddccd.filesusr.com/ugd/9ac058_4f7c49a1fa3d4d65934fb1b99a11dff9.pdf?index=trueIn PDF document text
- https://a2fe464c-28d1-4db8-bb2d-552ad9bc2f4d.filesusr.com/ugd/941bb1_51107d5f489e4fe5a1c21305bc3eabef.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/729d4569-10b1-4f79-a1d6-a55122d1e766/kesuvinasapugox.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fba8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBA8 | 5736 bytes |
SHA-256: 1111bc0ddbf78d23219763ba0c9a95b58ccb01fd1bd1d63f06b77b6ac199e15f |
|||
font_01_sfnt_off00010f2f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F2F | 10764 bytes |
SHA-256: 9d9b17a3ddd440075a47d1d1c906bfa957ecf3966ae36bec976b9d2a00a2d182 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.