MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document contains a large number of external links, a common tactic for distributing malicious content or conducting phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' strongly indicate this malicious intent. The ML classifier and ClamAV detection further support the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=broan+nutone+bath+fan+motor PDF link annotation
- http://lozhobelir.space/luzuvipetuxatovuredebumoljwip.pdfIn PDF document text
- https://jiwonilasipa.weebly.com/uploads/1/3/4/3/134313366/kepisofesovaluz-junenobere-tagofaluleponis-gelebowivim.pdfIn PDF document text
- https://cdn.sqhk.co/nixafusoda/hdzxxmr/retroflag_gpi_case.pdfIn PDF document text
- https://futixaxez.weebly.com/uploads/1/3/4/5/134516919/7460761.pdfIn PDF document text
- https://cdn.sqhk.co/libuzewis/hdYfhjT/app_media_box_android.pdfIn PDF document text
- https://momexifolel.weebly.com/uploads/1/3/4/3/134319719/277530207aa9fe.pdfIn PDF document text
- http://hookup756.fun/which_vitamix_should_i_buy_2020f3q8j.pdfIn PDF document text
- http://perevod-card2card24.site/no_fear_shakespeare_twelfth_night_act_2_scene_4wfft5.pdfIn PDF document text
- https://cdn.sqhk.co/ronejudutiso/d4hgjgh/biwetalazokoromidubivezu.pdfIn PDF document text
- https://zurokexotuv.weebly.com/uploads/1/3/1/3/131384071/ridek.pdfIn PDF document text
- https://napokepuwaju.weebly.com/uploads/1/3/1/1/131164128/035b0320bb.pdfIn PDF document text
- https://cdn.sqhk.co/jotepomi/nhiyWGn/voleradixagomesolog.pdfIn PDF document text
- https://domirirezup.weebly.com/uploads/1/3/5/3/135382932/efb9ce8b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_8ea3196f78904278bf9f4c9cefe5f9cb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/24981d86-4ca3-44b5-b433-1cd84a914926/pebosiduwewogeleso.pdfIn PDF document text
- https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_3251f7890e29441292125b0e17757730.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7ffdd34a-db56-430c-80b9-067d0270f840/the_spiritual_man_by_watchman_nee.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2dfa5538-3b92-4e35-a206-dc50545ef25f/think_pair_share_strategy_research.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a75bd52e-fba7-49ac-8638-de66eb51ef5f/cateye_velo_5_setup_instructions.pdfIn PDF document text
- https://ced6af22-cf5f-4df0-9cd6-2d424634d287.filesusr.com/ugd/3eed2b_812d36a94f0f49eeb8741584a7a3bf46.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/437a6728-4c33-4036-8e44-90f4696ca957/pejigonexosutavefebiw.pdfIn PDF document text
- https://e61e9f85-32c5-4861-9fd4-b89109084c35.filesusr.com/ugd/2e4eb4_d17fa05ca7074b3fac36044d7cfa4d12.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d17d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD17D | 4988 bytes |
SHA-256: e583e9a983ec639be0b046cc65515afb2b033ee11caab95a6b1d9de6e4b67364 |
|||
font_01_sfnt_off0000e24d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE24D | 10200 bytes |
SHA-256: f99e7d718360cb0b370d48dd854d685bd46876f3d606d6e6865cfb9cc1d3b8c2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.