MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many of which are designed to appear as legitimate document downloads but lead to potentially malicious domains. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host phishing content. The ML classifier and ClamAV detection strongly suggest malicious intent, consistent with phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9925
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=blank+chord+chart+guitar+pdf PDF link annotation
- https://duvafoxugijotad.weebly.com/uploads/1/3/5/3/135305538/migowitu.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4422134/normal_5feccb9915555.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379471/normal_606df923e1345.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460228/normal_5fd78b0d24a8f.pdfIn PDF document text
- https://felonuwonab.weebly.com/uploads/1/3/0/8/130814100/d6e84ff.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4386594/normal_605f3bec3c0d6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4490746/normal_5feb570742c2d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/vososasoxumete/new_arkestra_video_song.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5dfe4672-c3b4-44fe-860c-7c03a5b2cb86/waforuvof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ea9cc33-a71a-43c9-b87e-d06409447de9/what_are_all_the_rappers_that_died_in_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1973acad-381c-464a-a3d6-c78c86446603/35080545742.pdfIn PDF document text
- https://s3.amazonaws.com/sosupejuxofedo/how_to_schedule_a_mn_road_test.pdfIn PDF document text
- https://s3.amazonaws.com/xoxaneral/getobefolorupogupame.pdfIn PDF document text
- https://s3.amazonaws.com/baxunaf/wemipuwidavetovisevuwos.pdfIn PDF document text
- https://s3.amazonaws.com/gidibesuxi/deficiencia_de_vitaminas_e_minerais.pdfIn PDF document text
- https://s3.amazonaws.com/tuxalowafokuvo/what_were_the_major_events_in_the_great_depression.pdfIn PDF document text
- https://s3.amazonaws.com/viwoxuz/20889578516.pdfIn PDF document text
- https://s3.amazonaws.com/widiku/98357862963.pdfIn PDF document text
- https://s3.amazonaws.com/vipuxafol/lagu_dj_via_vallen_lily.pdfIn PDF document text
- https://s3.amazonaws.com/tiduro/fix_problem_pes_2017_steam_api.pdfIn PDF document text
- https://s3.amazonaws.com/tokatefozude/english_tagalog_sentence.pdfIn PDF document text
- https://s3.amazonaws.com/wetevali/21431741911.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/26153e05-cbad-4f57-adb8-aef627844bec/blackdecker_st5530-gb_corded_grass_strimmer_550_w_review.pdfIn PDF document text
- https://s3.amazonaws.com/sinamozagemoger/free_background_pictures_for_pc.pdfIn PDF document text
- https://s3.amazonaws.com/lonozote/2018_all_bollywood_movie_movies_counter.pdfIn PDF document text
- https://s3.amazonaws.com/mujesogi/26731465070.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2f7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2F7 | 5116 bytes |
SHA-256: fccf584a39fe2c0297ef247026b8fdb455400893634ece68ef7108736f255376 |
|||
font_01_sfnt_off0001044e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1044E | 10624 bytes |
SHA-256: 007311bc937ffb0bf884df182d872157839d9bfb281f351671d8a1fa59bc51d0 |
|||
font_02_sfnt_off0001290b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1290B | 16076 bytes |
SHA-256: 1bea3cf48129970b4bef31e8bed444df132ece4266537fe2143d5588e04d2560 |
|||
font_03_sfnt_off00013dae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13DAE | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.