MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable domains, suggesting a link farm or phishing campaign. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a spearphishing attachment designed to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/123?utm_term=textbook+of+bacteriology+pdf+free PDF link annotation
- http://123dutch.com/xejebapugavotevakokefaxog25cyc.pdfIn PDF document text
- https://cdn.sqhk.co/vuvapolaxaj/Sgc4hhP/bcg_attorney_search_jobs.pdfIn PDF document text
- http://rcasino.info/man_the_unknown_bookcbwlv.pdfIn PDF document text
- https://zurukonovode.weebly.com/uploads/1/3/1/3/131379219/9084695.pdfIn PDF document text
- https://cdn.sqhk.co/fematixub/wxgfZgd/tanipedevafirezu.pdfIn PDF document text
- http://gelchlen.fun/motu_patlu_cartoon_movie_vs_mobivj5qm.pdfIn PDF document text
- http://kismykeitio.best/ballard_high_school_service_hoursj558q.pdfIn PDF document text
- https://cdn.sqhk.co/xubupigegi/h8fcijA/21128377008.pdfIn PDF document text
- https://guzovadolo.weebly.com/uploads/1/3/1/6/131606502/gesanamizivebitoseto.pdfIn PDF document text
- http://henrysavbr.site/las_vegas_to_grand_canyon_bus_tours_dealsjly67.pdfIn PDF document text
- http://pubggaming.online/charlie_tamil_movie_isaiminix3fsj.pdfIn PDF document text
- https://wanusasa.weebly.com/uploads/1/3/1/0/131070791/5773975.pdfIn PDF document text
- https://cdn.sqhk.co/zanivuwiduvo/dBTqieJ/best_tv_deals_today_amazon_prime.pdfIn PDF document text
- http://introdom.ru/xisomam6u1z.pdfIn PDF document text
- http://sneakerspapa.store/nefenultr9fe.pdfIn PDF document text
- https://felezawobo.weebly.com/uploads/1/3/4/8/134896203/3395007.pdfIn PDF document text
- https://cdn.sqhk.co/padezeda/egl5gQs/knife_throw_knife_hit_fruits.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://3682d434-6e27-4ac8-9ac2-d3ec24fa429c.filesusr.com/ugd/9b5f63_c638d48f07804eeaa8f83d07f15d788b.pdf?index=trueIn PDF document text
- https://aa3bb5c3-2bd4-4791-9e2a-6e31d5009b04.filesusr.com/ugd/60e703_58d22523fd604af5b6caa3564337ab94.pdf?index=trueIn PDF document text
- https://8533cbf3-c0d6-400c-bdf8-8ca38cf0242b.filesusr.com/ugd/135178_32582d7ce42d48feae08e53adce56d50.pdf?index=trueIn PDF document text
- https://68358877-4ee6-4e53-94f7-4bd9665c1f53.filesusr.com/ugd/3bbd68_d7d5d7bd4f474648bc613ebab8789c9c.pdf?index=trueIn PDF document text
- https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_7b3a0b796b1245fd8098ac275564d090.pdf?index=trueIn PDF document text
- https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_6d6cdc8c036140e0ac7b03ce156d6c2c.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cfcf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCFCF | 5468 bytes |
SHA-256: e992927c49c5313fdd7f00d61eb862bef9554184ebe56b839920118fb16cb597 |
|||
font_01_sfnt_off0000e284.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE284 | 10496 bytes |
SHA-256: 7e12bffda2ce22d155be548f4cd5af53446fcc01d2b977c20184eba3011ee89f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.