MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The presence of the 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristics strongly suggests this malicious intent. While no scripts were directly extracted, the ML classifier and ClamAV detection indicate a high likelihood of malicious content, potentially delivered via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=our+night+sky+great+courses PDF link annotation
- http://xuwivezotuw.22web.org/mario_benedetti_te_quiero.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366009/normal_603b69cce587a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4464078/normal_6035d3e154a44.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4379852/normal_5fc9c35ca226e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448558/normal_5fd64e9f8ab3d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/kukazowox/wekudikeduketo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2797ae99-ade9-40c2-a275-8c76de854fb9/how_to_remagnetize_a_brushless_generator.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a95b0884-1e7d-4e74-9c31-1e9878f9f399/39220067206.pdfIn PDF document text
- https://s3.amazonaws.com/luramamelolem/thinkorswim_mobile_scanner.pdfIn PDF document text
- https://9cc02d22-446e-415d-9686-6e49aadcb3b3.filesusr.com/ugd/aa6a08_105bc03d7c0443c598be67e936b56004.pdf?index=trueIn PDF document text
- https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_9ecf5feb5c464c3a8de3b37c10c40e4d.pdf?index=trueIn PDF document text
- http://pisotusapuveg.epizy.com/273437247.pdfIn PDF document text
- https://s3.amazonaws.com/gavapozalilup/what_helps_you_get_rid_of_pimples.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22550606-64b5-44c5-bfba-e598882651f3/zusixovuraz.pdfIn PDF document text
- https://cad90261-f038-4e8a-b384-2e0e37e6cb8c.filesusr.com/ugd/4c4e45_926956a559dd46ffb6dc123d1b27e92c.pdf?index=trueIn PDF document text
- http://rinudesit.epizy.com/aviation_weather_faa_handbooks.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b485373-7e31-4302-b906-32fd4a640ce3/how_rare_is_a_brindle_dachshund.pdfIn PDF document text
- http://bujavajivedejin.rf.gd/53797445255.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc517e54-a666-4141-8b94-f08546f2728c/the_revenant_full_movie_free_download_in_hindi_dubbed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fccd386d-42e2-454e-8fab-3b613b0c2c41/apollo_twin_x_usb.pdfIn PDF document text
- http://baverasoge.epizy.com/lirawowaz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/003cf90b-ffbb-48c5-923e-66be5bb359af/crochet_blanket_for_beginners_youtube.pdfIn PDF document text
- https://s3.amazonaws.com/kaxukok/49233842780.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010258.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10258 | 5224 bytes |
SHA-256: b3f7751e12165b67887704b4c3d9a712e27363b24c81b43d064d6ac40b6784af |
|||
font_01_sfnt_off00011422.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11422 | 11104 bytes |
SHA-256: 2101aa581c40c28781f507d347424ce02beb252b51a0800dc710dd452114a937 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.