MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a link farm with numerous external links, many hosted on disposable domains, suggesting a phishing or malware distribution attempt. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' indicate a large number of links designed to appear as search results. The presence of a URL pointing to 'dugedepap.ru' with a query parameter suggesting a driver download further supports a lure-based attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=realtek+audio+driver+windows+7+32+bit+compaq PDF link annotation
- https://cdn-cms.f-static.net/uploads/4454170/normal_606308bc11d7c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408865/normal_5fd7a358a2eb1.pdfIn PDF document text
- http://vozuzutiwajuzip.getenjoyment.net/fungal_colony_morphology.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4471252/normal_5ffa4356072a7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4479210/normal_6021bf5c5ea8c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4469641/normal_5ff524bfb521e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414159/normal_5fd7ec3519582.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403417/normal_5ff8ffe52d1c9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402507/normal_605cac143496e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413473/normal_6045115daec28.pdfIn PDF document text
- http://bopolubolef.mywebcommunity.org/how_did_the_methods_and_subjects_in_art_change_during_the_renaissance.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382192/normal_606df8640fee0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://c4a0f302-b060-43a0-af10-a0364da5eca7.filesusr.com/ugd/c6d327_deb98aa46ba244c58a4723c7952002c5.pdf?index=trueIn PDF document text
- http://vigavanoxe.onlinewebshop.net/rilafoxemave.pdfIn PDF document text
- https://a6668164-4238-4e0d-addb-cc4c62f58fca.filesusr.com/ugd/2dfcca_d5a4cbaeb76a4423ba546bbdb8ceedc3.pdf?index=trueIn PDF document text
- https://ec08fec6-e576-400d-8504-372613838d3c.filesusr.com/ugd/57e0ce_b2d1ee369f3143a0a618521712ea37e5.pdf?index=trueIn PDF document text
- https://98350ace-7ac4-4f38-a9d9-579fdad8050b.filesusr.com/ugd/9b2d9b_dc8ccc83e5b548c7a35966a985ad9b0e.pdf?index=trueIn PDF document text
- https://de315c38-daa2-4293-b666-e554ba9b7d65.filesusr.com/ugd/564d2e_7fea33fd1b984fbca795cc6e17658fab.pdf?index=trueIn PDF document text
- http://bumurulepowele.myartsonline.com/gameg.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f82f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF82F | 6084 bytes |
SHA-256: ea2ec0fab1f7bd7c3dd63ff957da9d0bcae896736977aeb55ad4eddaedb4d1a6 |
|||
font_01_sfnt_off00010ce3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CE3 | 10692 bytes |
SHA-256: 17b6922cbffd742f0fa6bcaa9e1449b9adc6885c1a1653af5d310ff39ac69b02 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.