MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=fcra+certification+exam+answers PDF link annotation
- https://gubulugovidenu.weebly.com/uploads/1/3/1/4/131406252/5478069.pdfIn PDF document text
- https://wipukanutunuk.weebly.com/uploads/1/3/1/4/131437017/8713585.pdfIn PDF document text
- https://jokisutenewaj.weebly.com/uploads/1/3/1/4/131483229/c4b9565be2.pdfIn PDF document text
- https://lunokebu.weebly.com/uploads/1/3/4/6/134648327/basolapasire.pdfIn PDF document text
- https://bopugokux.weebly.com/uploads/1/3/4/9/134901566/kujenutexatemol.pdfIn PDF document text
- https://nanuvofekoredam.weebly.com/uploads/1/3/5/3/135385966/tabojaforale_dufokejumepiren.pdfIn PDF document text
- https://nipixosawapur.weebly.com/uploads/1/3/1/1/131164079/zivenu_bejovuvapufiwo.pdfIn PDF document text
- https://puzifisabu.weebly.com/uploads/1/3/1/3/131378936/a30bdb60d.pdfIn PDF document text
- https://kiseridebajesa.weebly.com/uploads/1/3/1/4/131408791/koxoxowexobunak-siwosajebe-bevigod-katugewed.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/928bd3d5-9bdc-4050-bcbf-4de73a718c7d/basoxejoxiriregu.pdfIn PDF document text
- https://s3.amazonaws.com/foneniz/does_burger_king_have_grilled_chicken.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38826858-b520-49ff-8757-144477721343/1256594026.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30f2bb7f-0250-4149-bd16-1d3799e47b63/human_anatomy__physiology_laboratory_manual_cat_version.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28baf2c6-6060-45dc-89df-833329157b60/what_are_the_different_types_of_fabric_finishes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46be3c74-551c-4c8d-ae8b-d785a746a625/rebijanififo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d163a500-d685-49a5-9e66-cf87bd5ab5a1/cuales_son_los_derechos_humanos_en_venezuela.pdfIn PDF document text
- https://s3.amazonaws.com/wurivuve/descriptive_and_inferential_statistics_worksheet_with_answers.pdfIn PDF document text
- https://s3.amazonaws.com/tizowodifi/antilogarithm_antilog_table.pdfIn PDF document text
- https://s3.amazonaws.com/zibenoroduzuw/franchise_contract_template.pdfIn PDF document text
- https://s3.amazonaws.com/fibesezati/pamamilapadibatexugifoxom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53ec2a10-eb07-4551-a227-dfc40f3460b1/present_simple_exercises_for_beginners.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ddaea6d9-8041-41f6-8263-737ed821293a/bixiwugovaxudidebekol.pdfIn PDF document text
- https://s3.amazonaws.com/fuwawibu/lg_32lf500b_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/90d82690-3369-4433-b99c-9b66ca5f6ab1/92613404907.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efd5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFD5 | 5112 bytes |
SHA-256: 22a6f727b893c6f7d624dd9d0fb9d66c7602640a9edb0df78dc92f239ae3799d |
|||
font_01_sfnt_off0001013b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1013B | 11640 bytes |
SHA-256: b5f6d23b74c078c4a9c64f77b429b658d58c9e2dd28e83f7a137f336d219b35c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.