MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The file contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation scheme. One of the extracted URLs, https://garglob.ru/pbw?utm_term=human+figure+step+by+step, is particularly suspicious. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://garglob.ru/pbw?utm_term=human+figure+step+by+step PDF link annotation
- https://mofizuzu.weebly.com/uploads/1/3/4/3/134316779/sajatokapupibi.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464735/normal_5ff7a0c26d9cb.pdfIn PDF document text
- https://vuvitujenus.weebly.com/uploads/1/3/4/3/134305132/5e81e3e83.pdfIn PDF document text
- https://nolizusumebixaz.weebly.com/uploads/1/3/1/4/131438071/vafisaka-wixelu-lotefuvijefu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4373999/normal_603cab10d1a11.pdfIn PDF document text
- https://gokebapin.weebly.com/uploads/1/3/5/3/135320588/ada5b6a0.pdfIn PDF document text
- https://fisudobu.weebly.com/uploads/1/3/0/8/130813554/sulazivoreruja.pdfIn PDF document text
- https://wajabanafeku.weebly.com/uploads/1/3/4/5/134599300/3167478.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6b8e659e-0847-4e73-b04d-dac0e8fc10d7/7300542809.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8359620-1f31-4157-a13a-fb5c085a9fad/86421420672.pdfIn PDF document text
- http://jajisaparev.pbworks.com/f/duralast_700_amp_portable_battery_jump_starter_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6cc6a816-217c-438e-a5ae-fdfe75124ef0/56261086317.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ab1547f-dd32-490c-a1fb-289dc90b84a5/vijumixita.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/82946cbb-e2a6-4de0-b223-091fa350859c/oracin_de_san_cipriano_para_enamorar_a_una_mujer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6dc946d1-c127-4fa1-ad53-18a8024649e0/7812152269.pdfIn PDF document text
- http://zanopadik.pbworks.com/w/file/fetch/145170906/valupewumazazeka.pdfIn PDF document text
- http://betifabito.pbworks.com/w/file/fetch/144796764/introduction_to_networks___6.00_-_itn_chapter_4_exam.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15a38bd8-f275-4807-a9e8-4592357be876/sapovurujelokiromate.pdfIn PDF document text
- http://kirozatijawu.pbworks.com/f/lorotukoxu.pdfIn PDF document text
- http://pewudomame.pbworks.com/w/file/fetch/144615567/xonaforuwisos.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8db.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8DB | 5392 bytes |
SHA-256: fe293f45fd977ee0bd22bd9e5acf965330f0e47484a770a055318e8869b03097 |
|||
font_01_sfnt_off0000fb20.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB20 | 10748 bytes |
SHA-256: e1163b2986cb4885f6c10bfdff3ddb63f0ccfb85dc17a5ce119aa079bf1b1f99 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.