MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a clipboard-command (paste-and-run) lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/123?utm_term=bypass+ssl+pinning+android+emulator PDF link annotation
- http://seplafond.xyz/17758645981p9oox.pdfIn PDF document text
- http://wosedumuf.mywebcommunity.org/waxojewalitazelejumom.pdfIn PDF document text
- http://antonioit.fun/bijumirujd9ryk.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378160/normal_5fcdd17e1c43f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480594/normal_603091d34e84e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4377109/normal_5fe920626bea8.pdfIn PDF document text
- http://ses-paypal.com/2006_6.0_powerstroke_turbo_rebuild_kitjiwoa.pdfIn PDF document text
- http://peluxuba.sportsontheweb.net/xutepimejarovujekalunajud.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370767/normal_6023fe2f5b5ee.pdfIn PDF document text
- http://wppremium.org/sekodebi1hvko.pdfIn PDF document text
- http://navevukosuso.mypressonline.com/architecting_for_scale_free.pdfIn PDF document text
- http://sevezor.scienceontheweb.net/how_to_change_nutone_light_bulb.pdfIn PDF document text
- http://lnstagram-office.com/dell_inspiron_1720_price_in_pakistani8bbg.pdfIn PDF document text
- http://bidimiw.sportsontheweb.net/80328962564.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491665/normal_6019f391bed8d.pdfIn PDF document text
- http://mekapidi.medianewsonline.com/five-minute_mysteries_collection.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://zesafemumibow.myartsonline.com/verokawuloliwa.pdfIn PDF document text
- http://nisetekotixob.myartsonline.com/84239233996.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/533daab9-0148-449b-b12c-db3920586a4f/takelumugukopate.pdfIn PDF document text
- http://minivenema.atwebpages.com/metabolismo_de_hidratos_de_carbono_lipidos_y_proteinas.pdfIn PDF document text
- http://gowepuxajotezo.onlinewebshop.net/how_long_can_fleas_live_without_air.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2e444e2-1866-46b2-b10c-c999d52ac5ed/20482063893.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bec71437-e33b-4999-8064-5c5ea85d48ba/87053344622.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c78b40f4-f6b5-4372-ab58-1f121565c22c/how_much_is_omnisphere.pdfIn PDF document text
- http://dapizodipe.myartsonline.com/9931856626.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f738.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF738 | 5428 bytes |
SHA-256: 1ff4ff1c71f8765a4071f26cc78f2c74eba569c8be9171844c42712a373a9f2b |
|||
font_01_sfnt_off000109a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109A5 | 11468 bytes |
SHA-256: ba3d2c19291e2a411dedb48c502192ba67b8799d04ab5df79a8a21df082d958f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.