MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a significant number of external links, indicating a link farm designed to redirect users. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and ML classification strongly suggests malicious intent. The embedded URLs and the heuristic firings for PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM confirm the document's purpose is to distribute traffic to potentially malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=bosch+4100-10+table+saw+review PDF link annotation
- https://cdn.sqhk.co/vibebexez/hfij3ji/gravitrax_starter_set_ebay.pdfIn PDF document text
- https://famutogerene.weebly.com/uploads/1/3/4/6/134688643/sumone_pusedolubo_dagevofez_fivomom.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366010/normal_601dfbe8f297e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459325/normal_5fe808a9df9be.pdfIn PDF document text
- https://cdn.sqhk.co/nivazesoj/cjahr83/lotibatamaxobekevezu.pdfIn PDF document text
- https://cdn.sqhk.co/detatakev/QheugcC/nevitepetazenobojagubetem.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369647/normal_5fd9d19c6539d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482848/normal_605c04aa8f19a.pdfIn PDF document text
- https://cdn.sqhk.co/lebudawojafi/l7ggAhg/ringtone_new_islamic_download.pdfIn PDF document text
- https://cdn.sqhk.co/gixelotopa/ia3jbje/gavulafafamesufadujipop.pdfIn PDF document text
- https://xelopapet.weebly.com/uploads/1/3/0/7/130775154/wujajukikamu-xales.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417995/normal_5ffa41f9cf488.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/budovewesekaz/trust_balance_sheet_format_2018-_19.pdfIn PDF document text
- https://368af19b-b9be-4417-8ea7-dfc4611f9fec.filesusr.com/ugd/abd4c0_9e6d894275104119a2f5bbc0d03a1416.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/bezutu/20513167868.pdfIn PDF document text
- https://s3.amazonaws.com/toguvaju/zukubu.pdfIn PDF document text
- https://s3.amazonaws.com/gurafoga/yiruma_kiss_the_rain_sheet_music_guitar.pdfIn PDF document text
- https://09235f31-469a-4613-94fc-36d04c1f642a.filesusr.com/ugd/8b6407_cfa8b09a999e41509d1373a5801cb76e.pdf?index=trueIn PDF document text
- https://5663e088-3595-439c-971a-5873693bee35.filesusr.com/ugd/e98895_9f25c81334604525ad3d65adb2ea03fd.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tafogusegabomu/alliant_energy_power_outage_reporting.pdfIn PDF document text
- https://s3.amazonaws.com/rurosaveruk/jijigimoritilebiwovilo.pdfIn PDF document text
- https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_baa39faf861b4e2695194647d183e0ea.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb94.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB94 | 5540 bytes |
SHA-256: ca58625c348b5a6ea61f6865928780fff6e030f92982e2c8f2f0843723e7c955 |
|||
font_01_sfnt_off0000fe98.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE98 | 11008 bytes |
SHA-256: 334708ac8b872d5be5a572f5f3d96bca94d3b9e026219696612ec6e95f6316d3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.