MALICIOUS
244
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged for containing malicious redirector links and acting as a link farm. The embedded URLs, such as 'https://yafferge.ru/strik?utm_term=how+to+program+a+wayne+dalton+quantum+garage+door+opener' and 'http://sollabs.xyz/cafeland_mod_apk_2._0._30gkpdl.pdf', are indicative of phishing or malware distribution attempts. The document's structure and content suggest it's designed to lure users into clicking these links, likely leading to further compromise.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://yafferge.ru/strik?utm_term=how+to+program+a+wayne+dalton+quantum+garage+door+opener
- http://sollabs.xyz/cafeland_mod_apk_2._0._30gkpdl.pdf
- https://static.s123-cdn-static.com/uploads/4447087/normal_5ff69c69811f7.pdf
- http://itactical.xyz/wenidudilajemuzawuvine4qy.pdf
- http://nofubajabuv.medianewsonline.com/fobawizuzokexami.pdf
- http://magic-spring.com/16274253484fnavl.pdf
- http://reduslimitalia-oficial.site/bootable_pen_drive_format_softwaredaea7.pdf
- http://4338bacchus.com/5301451562w03vz.pdf
- https://static.s123-cdn-static.com/uploads/4465133/normal_5fefcd45acfa7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://db6a684c-bd73-4a61-997a-17040cc1d896.filesusr.com/ugd/bbbb20_5153bf55571e4ecfa14a69779989531e.pdf?index=true
- http://zogadawedalifap.onlinewebshop.net/94809132574.pdf
- https://uploads.strikinglycdn.com/files/584eafdf-6e64-4e46-96bb-e56c4fd8bd4f/lijokategokilitulodikawiw.pdf
- https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_b2122b1009bd4c7fbeac452eb442d398.pdf?index=true
- https://uploads.strikinglycdn.com/files/d9c4ff44-62ef-4a19-b95e-dbfa28a02140/rejaw.pdf
- https://e5447efa-8854-4d04-834e-f0bbd7438c8b.filesusr.com/ugd/ac612b_d1f711c41cd8408e8bf6db3c7aca92b5.pdf?index=true
- https://5637a596-61ce-4e67-8953-8fd9cb84b940.filesusr.com/ugd/c20ea7_3defd984257a4e9cb1e0e4ee87f9c206.pdf?index=true
- https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_c38af371b5a142589c1e93f721c86eb8.pdf?index=true
- https://5057b38b-f250-4925-a5fd-2dbc054a2c1f.filesusr.com/ugd/25ee37_5bdaf44683a44f29994f52c8d37f92ba.pdf?index=true
- https://uploads.strikinglycdn.com/files/7f1b1d2a-31fe-40a8-a548-d1a4524238c0/73483918637.pdf
- https://e06e8306-d71e-4c92-aa1b-e8c52eeb44cb.filesusr.com/ugd/bc4951_3fa3601f6ea94268860fd0031736771f.pdf?index=true
- https://2f8a6ab9-e864-4757-b083-6627a13f4c48.filesusr.com/ugd/405339_c96f0c036c8246058627d6f972b7e957.pdf?index=true
- https://d2ffd92d-ad89-4e9b-8359-126286817a3c.filesusr.com/ugd/dd9784_9d2f4cc6fee94b2daf48db3b45bd63e3.pdf?index=true
- http://pimimozoji.myartsonline.com/homelite_179cc_pressure_washer_oil_change.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cf71.bincf79f8ff3e3351374a877ecca0d34caa0fa3b710a61d1c721af9330f46d6430a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCF71 | 5384 bytes |
font_01_sfnt_off0000e1b6.binde2d13e4840d8d488878cf20b17d2cd4b08941b3f2a3014aecb302662cd6707b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE1B6 | 9764 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.