MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by a machine learning classifier and ClamAV. It contains a large number of external links, many pointing to disposable domains, indicating a link farm or phishing operation. The primary malicious URL identified is https://seumenha.ru/strik?utm_term=fl%25C3%25A4chen+in+google+earth+messen. No scripts were extracted, but the PDF structure itself is designed to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=fl%25C3%25A4chen+in+google+earth+messen PDF link annotation
- https://wukelefitifaka.weebly.com/uploads/1/3/4/8/134882985/1813141.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407996/normal_5fc875fb29d61.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372960/normal_6063a4e808d44.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495684/normal_60030dd3ce3ef.pdfIn PDF document text
- https://lawepisofav.weebly.com/uploads/1/3/4/4/134473025/7b8aca3a1446296.pdfIn PDF document text
- https://kogevinipuban.weebly.com/uploads/1/3/4/5/134514077/fetunaronenojaw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372360/normal_60364ca00f454.pdfIn PDF document text
- https://riviruzo.weebly.com/uploads/1/3/0/7/130739493/7363517.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4425229/normal_5fc86856e4147.pdfIn PDF document text
- https://tabivivefevevu.weebly.com/uploads/1/3/4/8/134889686/nezokip-zitis-tadeb-xiresesumik.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/74b0e8e9-c2b0-4d50-85ff-e2e1bf4175fa/bizolu.pdfIn PDF document text
- http://wejonixegovut.rf.gd/absolut_vodka_cocktails.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a43433df-457d-4707-a99f-7c442f760540/22543313539.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7c46ecd-bf69-4f69-ae8d-63f73b8c5549/nunotalisoluzaginosirux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da60ee46-abe4-4f50-a6a9-06708de90fff/liana_lowenstein_assessment_and_treatment_activities.pdfIn PDF document text
- https://s3.amazonaws.com/bevekizadoxuj/whatsapp_business_plus_mod_apk.pdfIn PDF document text
- https://s3.amazonaws.com/lakadutof/mudibusevoxa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96feab15-93e4-4804-8bf8-00ed1556c191/learn_to_play_bass_guitar_for_beginners_free.pdfIn PDF document text
- http://vebavibokifoko.epizy.com/18866245575.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/acbea165-196e-48f6-89a2-93997fbfbb2b/is_triss_mom_divergent.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e27c8c2f-1359-4c71-811f-36c0f6f29589/40145410154.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011bf8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11BF8 | 5192 bytes |
SHA-256: 95724e93a5000693cf8efda9ad1e056d8bc248b6bfda9f930add7754196d2a7a |
|||
font_01_sfnt_off00012cd3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CD3 | 10648 bytes |
SHA-256: 1e883dc066db92012de141e66a9755c439149a31689f753b6e44debf5ae79e2a |
|||
font_02_sfnt_off00015165.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15165 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.