MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=top+logo+design+apps+for+ipad PDF link annotation
- https://cdn.sqhk.co/ligumorik/dxjdhh9/kugafofemonurewenifuwas.pdfIn PDF document text
- https://cdn.sqhk.co/novigigexuxo/EdhdjcL/kafavobebugodilipo.pdfIn PDF document text
- https://cdn.sqhk.co/posogamumut/d3rIjhQ/40182716875.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/b724ba48-60e7-4bb7-9eef-f3fe7f91a1bd/what_diet_is_good_for_brain_health.pdfIn PDF document text
- https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_bd69084baba243e5b11d55cc1dbcaafd.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/314fabcf-ef7b-45c9-8509-64a5ae38a527/sharp_tv_red_light_blinking_2_times.pdfIn PDF document text
- https://s3.amazonaws.com/gateme/partnership_appropriation_account.pdfIn PDF document text
- https://72cee60b-533f-4fda-9f40-87b1bb6f0553.filesusr.com/ugd/590778_745b5595577340039e21a90e74516534.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4283d2f2-f414-410d-93b0-a2071241244e/85879917913.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7c21a5c-d741-4e70-939b-fce72f115cf8/nixil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7dc31c29-866c-484e-8dbb-8b9cf032ae9e/mogigofojonuro.pdfIn PDF document text
- https://2386e270-bd20-42c1-b3e5-1ba7eaa1d68d.filesusr.com/ugd/b4f0c6_e10d8d9637794d25903d9873e07d73b0.pdf?index=trueIn PDF document text
- https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_3838935ba679416aac53d7b46bf6a477.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fupanabivote/parallelism_worksheet_one_answers.pdfIn PDF document text
- https://0fc0baf9-b884-4fcd-968e-f93c0f938930.filesusr.com/ugd/68ec51_d5baafa98ac44d37b1fdd40943600041.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nijosinizo/el_estado_como_agente_economico.pdfIn PDF document text
- https://18cceff7-6d50-42ec-9d85-67184b61345e.filesusr.com/ugd/8c2e83_06173d9f38984fe395e540281386e94a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5988158a-7dd4-4056-ad06-775fcecef1a2/vidadel.pdfIn PDF document text
- https://d0fd22f1-78bd-4368-960d-2a324028b2bb.filesusr.com/ugd/a4d998_ce209817a7774af78c8976e462566557.pdf?index=trueIn PDF document text
- https://82cb18f6-4a40-4824-ac11-10070f72ce02.filesusr.com/ugd/5aec95_960cff9989bd4b258f31242c7d9ec898.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001072b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1072B | 4864 bytes |
SHA-256: 35510c498ef9efe8faa926bdd49461468f95238b0c4b852dc54e95be551a5cfa |
|||
font_01_sfnt_off000117bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x117BB | 11108 bytes |
SHA-256: b68dd53d8d47878a8e0e944d582e244561dbb90443c08929c3eb32d9ea8b64df |
|||
font_02_sfnt_off00013d83.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13D83 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.