MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting it functions as a link farm. One prominent URL, https://mezovuduw.ru/123?utm_term=aap+infant+feeding+guidelines+2019, is likely part of a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/123?utm_term=aap+infant+feeding+guidelines+2019 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4485446/normal_600489b24a792.pdfIn PDF document text
- http://selozufuwadapuw.66ghz.com/indecent_exposure_sentencing_guidelines.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369905/normal_60241f804c6d0.pdfIn PDF document text
- http://fodamibokaf.66ghz.com/acc_aha_national_cholesterol_treatment_guidelines.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://557345b1-98c6-442d-b460-9e357c178e5b.filesusr.com/ugd/dfb5f8_21647ce5d786428fa33126d4a4e8e04e.pdf?index=trueIn PDF document text
- https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_6f923a60632c4a78bd30cb90c051249d.pdf?index=trueIn PDF document text
- https://8d5bcf17-53f2-4f21-b585-7a27aef14131.filesusr.com/ugd/7baf93_1b8a5a76bc764b12b53cd16403bc7698.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cb03a5b4-c35a-4f85-91c7-692b6a16b1db/star_wars_knights_of_the_old_republic_2_darth_revan.pdfIn PDF document text
- http://sidunutisa.epizy.com/vesta_pro_font_free.pdfIn PDF document text
- https://0e01c86c-6ad9-43de-bc04-b8819f410213.filesusr.com/ugd/73c254_a861061282c744e8af169aaa33205cf9.pdf?index=trueIn PDF document text
- https://26c1613e-5d28-4fa3-89cb-3d2c9ab59faf.filesusr.com/ugd/fe83c3_44837860f1964cfb83cf0eb6a2c64311.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0c6e4e78-a14e-4158-bb19-a0d0f53ad9e4/on_course_skip_downing_7th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e636fb8d-f082-4e1d-86e6-e553b5cbbd9c/32772616548.pdfIn PDF document text
- http://kikesij.epizy.com/sufuxegejedegen.pdfIn PDF document text
- http://kiduvunizujenav.rf.gd/26883356314.pdfIn PDF document text
- https://d896c2b7-539c-4146-aa8a-b39d26e096d8.filesusr.com/ugd/a98ecc_b08e4569f0524afe83d0355894cead86.pdf?index=trueIn PDF document text
- https://da5bec28-7969-4117-8ffb-5069fce5e80c.filesusr.com/ugd/31593d_a0dfa997aee44105851eb5ac0455c8d7.pdf?index=trueIn PDF document text
- http://wemopax.rf.gd/samsung_hm1350_bluetooth_headset_specifications.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c0f020a-d53e-4474-9370-73f144359e19/mtd_lawn_mower_repair_manual.pdfIn PDF document text
- https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_a6bcb1305efd4ed0823c0ad60700d4aa.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e6d4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6D4 | 5584 bytes |
SHA-256: 5f38d6be69d4d6b40e5460a29e5bcdc56e6a5ceb5c0fefb61e387973614de37c |
|||
font_01_sfnt_off0000f9f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9F1 | 10552 bytes |
SHA-256: 38479a5412807840e300320d38c28e64d7bb250e6ac607835f2641b60f66c915 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.