MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/strik?utm_term=how+to+deep+fry+a+turkey+using+butterball+fryer PDF link annotation
- https://sujanumijixedi.weebly.com/uploads/1/3/4/5/134501714/gufuruzofagevibexodo.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387430/normal_5fdca2eedbb31.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382965/normal_603b2cc6907e9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500883/normal_6039e54f6ba86.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4457849/normal_604b4ed91221f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4483361/normal_5fc5b61c91a39.pdfIn PDF document text
- https://varanikugeju.weebly.com/uploads/1/3/4/6/134640125/ribuginudu.pdfIn PDF document text
- https://tawatoxox.weebly.com/uploads/1/3/4/0/134018263/podipumipi.pdfIn PDF document text
- https://megewesaj.weebly.com/uploads/1/3/0/7/130738707/3988826.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/pizivurapab/dovekapogekurexedezudikim.pdfIn PDF document text
- http://kifesafijupesob.onlinewebshop.net/allahabad_high_court_judgement_on_ram_mandir.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a776203-f278-4f5c-a667-d39cb37bdc31/14021270019.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83f33899-27b3-4169-b2a8-392c1bd88f6b/97880890213.pdfIn PDF document text
- https://s3.amazonaws.com/zifilobesumafi/9088887684.pdfIn PDF document text
- https://s3.amazonaws.com/xakapudakadu/ruxafugod.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/17afc9de-a201-4b4d-8b55-c14c0f17a27a/65977819469.pdfIn PDF document text
- https://s3.amazonaws.com/kizugokofo/technivorm_moccamaster_review_2018.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c37d6ed-c4e1-49d5-ae0e-85284a48884f/sosobabilopib.pdfIn PDF document text
- https://s3.amazonaws.com/kukazowox/gunogugisunir.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50b02ba8-6200-4f87-8b6f-d0b60aaa4b1a/ti_84_calculator.pdfIn PDF document text
- http://lesidiwajenowil.myartsonline.com/braun_series_9_cleaning_station_worth_it.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8b3d37c0-bf38-44b7-8a3e-77d6a55b1f52/tevorot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1892eec8-e19b-44f2-a8b2-1b74e36d7502/how_large_is_air_force_one.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f9bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9BC | 5568 bytes |
SHA-256: c0ea21374de0b270096516376507a133f7353d407514c5916cc21684817639f1 |
|||
font_01_sfnt_off00010cd6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CD6 | 11076 bytes |
SHA-256: 5dcb7a03816f3dd44bbc4694a7d0c8d6ccd0051ad9e487663f078db16d093f58 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.