MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/strik?utm_term=how+long+do+kenmore+front+load+washers+last PDF link annotation
- http://gelokan.sportsontheweb.net/57208462495.pdfIn PDF document text
- https://nolabuxovitu.weebly.com/uploads/1/3/5/3/135305824/137778.pdfIn PDF document text
- http://vexoxem.scienceontheweb.net/minority_scholarship_form_2020_20_download.pdfIn PDF document text
- https://revanesowokaw.weebly.com/uploads/1/3/4/6/134652238/mijuzuboniw.pdfIn PDF document text
- https://roxuvipiga.weebly.com/uploads/1/3/4/6/134637137/7a321f854b.pdfIn PDF document text
- https://gixisisopovi.weebly.com/uploads/1/3/4/7/134713576/2503574.pdfIn PDF document text
- https://vitumiwoz.weebly.com/uploads/1/3/4/6/134697216/6015075.pdfIn PDF document text
- https://rewajugelawuz.weebly.com/uploads/1/3/0/7/130738764/2298934.pdfIn PDF document text
- http://rovanenafet.getenjoyment.net/88802408732.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://8772a198-af03-49ef-8724-5feb7546cb8a.filesusr.com/ugd/436f04_47e7fb8b7cd44e33adfbdd78d8cc9de4.pdf?index=trueIn PDF document text
- https://5e9c932d-19a8-4d5a-a970-d4bc0bcb832b.filesusr.com/ugd/bae0a0_4728fd5fa1c74091b410ba6993aba7f2.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nowokil/cameron_dallas_she_bad.pdfIn PDF document text
- https://5e1449e8-5ae4-4a15-bc7a-ee23795bc964.filesusr.com/ugd/3a34a5_3cb993f05db9454497e256fa14579b8f.pdf?index=trueIn PDF document text
- https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_f50aa365a4ee4f82b10c20871ae0cca3.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wunojipu/abcd2_all_song_pagalworld._com.pdfIn PDF document text
- https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_879ea2872eca48afbf95579f5170b0ee.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nakuzafol/sonanatituvigodinawo.pdfIn PDF document text
- http://nejesezape.myartsonline.com/rules_of_play_book.pdfIn PDF document text
- https://s3.amazonaws.com/gekixadonuru/apa_ethical_guidelines_forensic_psychologists.pdfIn PDF document text
- https://aa3bb5c3-2bd4-4791-9e2a-6e31d5009b04.filesusr.com/ugd/60e703_b6174322ee9d4c7297b1f1982daff8d2.pdf?index=trueIn PDF document text
- https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_82b78cbc2c5c4ba59e30c55c059afd6a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e718.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE718 | 5180 bytes |
SHA-256: 07507034a66aaa82ba264072221f302a3b065fd69083fd4550f760e19d50c355 |
|||
font_01_sfnt_off0000f895.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF895 | 10520 bytes |
SHA-256: 97cc3bc7ca8d5960da9bf878551479f713de10717d5fbd6dfcaf9efcb5401b90 |
|||
font_02_sfnt_off00011c8d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11C8D | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.