MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO spam operation. The primary URL suggests a lure related to a specific product, likely to deceive users into clicking. ClamAV and ML classifiers confirm the malicious nature of the PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/strik?utm_term=qiaquick+pcr+purification+kit+qiagen+28106 PDF link annotation
- https://bidumijedurazi.weebly.com/uploads/1/3/1/4/131437194/6555605.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419195/normal_60430504720fb.pdfIn PDF document text
- https://cdn.sqhk.co/lewonuvaxu/eOQijCw/vozudexuwaf.pdfIn PDF document text
- https://nisixokavenofaf.weebly.com/uploads/1/3/4/8/134891603/zapova.pdfIn PDF document text
- https://dukowitemodilel.weebly.com/uploads/1/3/5/3/135316140/fukivulodorogo-ganoselex-woveturuvegoxe.pdfIn PDF document text
- https://bamewubi.weebly.com/uploads/1/3/2/3/132303354/c44d87eb469c46.pdfIn PDF document text
- https://niwonuruvi.weebly.com/uploads/1/3/4/7/134767359/susunawuzotoga.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367951/normal_60327ab10ef49.pdfIn PDF document text
- https://viwapuse.weebly.com/uploads/1/3/5/3/135306484/8c590b22.pdfIn PDF document text
- https://rilavowa.weebly.com/uploads/1/3/2/7/132740415/sugari.pdfIn PDF document text
- https://gokebapin.weebly.com/uploads/1/3/5/3/135320588/56ccd71af0f4.pdfIn PDF document text
- https://finenomasawovep.weebly.com/uploads/1/3/1/4/131437785/5891461.pdfIn PDF document text
- https://cdn.sqhk.co/gajerivab/EggKia2/xobenowalawepawelubiwiz.pdfIn PDF document text
- https://kojivijagidisu.weebly.com/uploads/1/3/4/0/134042347/xonagaw.pdfIn PDF document text
- https://cdn.sqhk.co/mikevoponage/ngdidie/clockwise_90_degree_rotation_calculator.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://c480cc3d-c044-45b7-a7fa-747782367dcd.filesusr.com/ugd/a26f59_0de9cee18ac941bc99a97298e9958442.pdf?index=trueIn PDF document text
- https://d4180a97-8dd0-4bf1-9e2f-d1b128d1a64d.filesusr.com/ugd/ae059d_2735e64ff0404a86894d8381c302bede.pdf?index=trueIn PDF document text
- https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_a2c2332293a0491085e0c01820dc64fb.pdf?index=trueIn PDF document text
- https://ca483b97-61ac-4196-bca0-6b249c18eca9.filesusr.com/ugd/b27199_a3d0a4b8e58f425b8fec34ce3004a022.pdf?index=trueIn PDF document text
- https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_93d7607406b54611a9cd9d27b6f805f5.pdf?index=trueIn PDF document text
- https://cbb9655c-b60d-4095-8c1c-bb5f9a2903c5.filesusr.com/ugd/4dd980_426fd5d1308d41719730458ce3b30363.pdf?index=trueIn PDF document text
- https://8a89c5bc-485b-4808-980c-66c60e8d9908.filesusr.com/ugd/834936_304f8059c7044cdfa27b8f9b99f3487e.pdf?index=trueIn PDF document text
- https://3ecb585b-79b8-4502-8567-d9a17299c5c1.filesusr.com/ugd/4b874d_a9ba5788cefd415b89fb5ab22a7ccc5e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001720c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1720C | 5896 bytes |
SHA-256: 4e2eb4cae08e0b5c4596660b028161f160fd79d6b203fcf6b18c301c0a08c8a1 |
|||
font_01_sfnt_off00018637.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18637 | 16120 bytes |
SHA-256: 540eae2520ef23a92130e727ad8d9f243bae2adb93480039428caccd1cf3499a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.