MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection (Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) and an ML classifier output of 0.999651. It contains a large number of external links, many pointing to disposable domains, indicating a link farm designed to redirect users to potentially harmful content. The embedded URLs suggest an attempt to lure users to phishing or malware distribution sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/wix?keyword=experiencing+mis+8th+edition+pdf PDF link annotation
- http://meetsoda.pro/torebobujigojobimekebub90d6.pdfIn PDF document text
- http://pedaxofanor.mywebcommunity.org/oster_food_processor_blade_stuck.pdfIn PDF document text
- http://lozejebivo.scienceontheweb.net/64181705778.pdfIn PDF document text
- http://introdom.ru/js_eclipse_pluginqdwha.pdfIn PDF document text
- http://9gusevshop.space/ford_mustang_gt500_super_snake_2020mq8ji.pdfIn PDF document text
- http://zibikudupe.mywebcommunity.org/78930600835.pdfIn PDF document text
- http://mukinokelek.mygamesonline.org/32916862901.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/bd397806-6d01-42b1-a5ab-f9b00b53cebd/merchant_of_venice_plot_summary_sparknotes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e9364b5-9336-4630-96a4-9ace159c8992/20827607266.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d4057c4-3022-4c33-befe-291ba984d783/xigufuvivozi.pdfIn PDF document text
- https://69a7f268-727d-4112-ba4f-a3538cc856be.filesusr.com/ugd/9a0d60_fc897e4509b14359a46f79d08d3f008c.pdf?index=trueIn PDF document text
- https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_44f119de2d7b4e44b7768ea6803e4157.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lodazojamuva/the_last_song_cast_little_brother.pdfIn PDF document text
- https://9de673a2-3b8e-40eb-bbf5-c0ad8e71a3da.filesusr.com/ugd/bd5c68_13b4456012aa4985b0d0a659e6f2fbf8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a49dcc60-7f91-4edd-91c4-f14161ec699b/singer_heavy_duty_sewing_machine_4432_manual.pdfIn PDF document text
- http://tokozod.myartsonline.com/74395562900.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/afcc8633-d3a4-4419-9820-f9fb4c828007/98959548552.pdfIn PDF document text
- https://s3.amazonaws.com/fosalizuzu/does_netgear_powerline_2000_have_wifi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53b191cd-9d26-4960-9580-9fb6146a6d38/27447608871.pdfIn PDF document text
- https://s3.amazonaws.com/xugigabitulu/standard_of_perfection_for_mini_rex_rabbits.pdfIn PDF document text
- https://s3.amazonaws.com/fedufiporara/does_lara_jean_end_up_with_john_in_always_and_forever.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc503693-9a94-4363-8b94-81dfec82f0d2/what_is_to_analyse.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010d1a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D1A | 5544 bytes |
SHA-256: 40ec7fd628ab7443de581a14e333dd9300a872b539cca42bfa3a929e97dda9d1 |
|||
font_01_sfnt_off00011fdd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11FDD | 11364 bytes |
SHA-256: d172e2d0fb1b4f2abcfbdf3022e4207305e6070b89fbcbec865de859ec9f1313 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.