MALICIOUS
116
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains numerous embedded URIs, many of which point to external websites, indicating a link farm designed to redirect users. The ClamAV detection and heuristic firings for PDF_URI and PDF_SEO_DISPOSABLE_LINK_FARM strongly suggest malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the nature of the embedded URIs and the overall structure point towards a spearphishing attachment as the likely attack pattern.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2795
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/uplcv?utm_term=configurar+dvr+giga+acesso+remoto+android PDF link annotation
- http://4bx.pl/public/file/10147170254.pdfIn PDF document text
- http://locum-system.pl/userfiles/file/serilewi.pdfIn PDF document text
- https://suacuacuontoanphat.com/upload/files/jazepuno.pdfIn PDF document text
- https://aquariumfargo.com/wp-content/plugins/super-forms/uploads/php/files/0fa9a5c7fc9b52a5548923a8703424ee/labedixovo.pdfIn PDF document text
- https://processwork.archerhuang.com/ConImg/files/berurakakula.pdfIn PDF document text
- https://citrasas.com/ckfinder/userfiles/files/25234044950.pdfIn PDF document text
- http://idealthailand.com/file_media/file_image/file/kosugixob.pdfIn PDF document text
- https://wickedcheesy.com/images/file/susogogegowagiwimamusemaw.pdfIn PDF document text
- https://dom4m.de/userfiles/files/32558585468.pdfIn PDF document text
- https://dcoderesearch.com/uploads/govomidotukuxo.pdfIn PDF document text
- http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/1613468b815021---62483101337.pdfIn PDF document text
- http://fjsxsx558.com/upload/files/71863987935.pdfIn PDF document text
- https://patc.fr/imagesfile/10055438880.pdfIn PDF document text
- http://vako.vn/app/webroot/uploads/files/diguwoxozawob.pdfIn PDF document text
- https://parquesanalbertohurtado.cl/ckfinder/userfiles/files/99893101692.pdfIn PDF document text
- http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613690a781009---43426536715.pdfIn PDF document text
- http://talani.nl/userfiles/image/file/libalapin.pdfIn PDF document text
- http://140.121.180.103/ckfinder/userfiles/files/54696403984.pdfPDF link annotation
- http://hotelamadeustorino.com/userfiles/files/33677552352.pdfIn PDF document text
- https://www.food-equipment-store.com/fckeditor/uploads/file/23026590679.pdfIn PDF document text
- http://www.stadion-zarya.ru/ckfinder/userfiles/files/zovezamexeko.pdfIn PDF document text
- http://dptour.net/bot/ckfinder/uf/files/30496885739.pdfIn PDF document text
- http://gabinetpro.gabinetpro.pl/kosmetyczka/krakow/files/16092802652.pdfIn PDF document text
- http://turar-mussin.com/userfiles/File/51786769692.pdfIn PDF document text
- https://www.bmo-agencement.fr/ckfinder/userfiles/files/tatawenimunasi.pdfIn PDF document text
- http://sushibelovo.ru/files/jikokotunemavozaz.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d6fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD6FC | 19428 bytes |
SHA-256: 6de337a06fad2b723637c0b7c47ca48d37631675c69c8a26840086f785ff75ec |
|||
font_01_sfnt_off00010aa5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10AA5 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off000122bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x122BC | 10972 bytes |
SHA-256: af1cd56f466dc02276ac9d61ae3a48dcae8a4846b423acb09b2134ec3e6a983c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.