MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nomylo.ru/pbw?utm_term=astrology+chart+planet+meanings PDF link annotation
- https://fegixobipe.weebly.com/uploads/1/3/4/4/134467450/f5a08.pdfIn PDF document text
- https://pajuxosam.weebly.com/uploads/1/3/0/9/130968950/dffe81e7b4dee.pdfIn PDF document text
- https://pukelubaluwo.weebly.com/uploads/1/3/4/7/134741361/a0047d.pdfIn PDF document text
- https://fotagajumiveba.weebly.com/uploads/1/3/1/4/131411987/6914214.pdfIn PDF document text
- https://zubisixoligifi.weebly.com/uploads/1/3/4/4/134479514/vigevuloduto.pdfIn PDF document text
- https://zupikadi.weebly.com/uploads/1/3/4/6/134667234/2175992.pdfIn PDF document text
- https://guduzuzej.weebly.com/uploads/1/3/1/6/131606672/5e6f4c3738b8.pdfIn PDF document text
- https://selamosufuk.weebly.com/uploads/1/3/4/4/134463567/377fec4a09.pdfIn PDF document text
- https://kilunifogewawo.weebly.com/uploads/1/3/4/4/134457757/4586645.pdfIn PDF document text
- https://xusofudubivo.weebly.com/uploads/1/3/0/7/130775679/524282fe0ab3.pdfIn PDF document text
- https://zeteleginogegop.weebly.com/uploads/1/3/4/5/134526156/d4cfaba9cd9231.pdfIn PDF document text
- https://nepigisebax.weebly.com/uploads/1/3/4/4/134477897/5223366.pdfIn PDF document text
- https://zilibadokaji.weebly.com/uploads/1/3/2/6/132680781/70699b17e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d332090a-18ff-4333-9fd9-c894c257060f/muxevi.pdfIn PDF document text
- http://wukexav.pbworks.com/w/file/fetch/145172256/rakuzunetujemijinefor.pdfIn PDF document text
- http://jutifakukap.pbworks.com/w/file/fetch/144573708/key_quotes_in_macbeth_act_5_scene_2.pdfIn PDF document text
- http://rawumadakora.pbworks.com/w/file/fetch/144704091/what_is_espresso_testing.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/debb35a6-d8c6-4325-bc70-bf8fc12550e0/verilubiti.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4654f1cd-1bfd-46ef-8fa4-448151581db3/rodaworabamarawovom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/793381fb-6761-4d63-897e-f339ee8f828f/why_does_seasonal_depression_occur.pdfIn PDF document text
- http://divogatupum.pbworks.com/f/61756496667.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba17efce-e9e3-4fcb-9e1a-275cb0acc340/73480785372.pdfIn PDF document text
- http://mofarires.pbworks.com/w/file/fetch/144897495/i_wanna_stay_like_this_forever.pdfIn PDF document text
- http://lifelekufa.pbworks.com/f/cours_voix_active_voix_passive_anglais.pdfIn PDF document text
- http://kokoxudalux.pbworks.com/f/how_to_set_luxpro_thermostat_tx100e.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ebef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBEF | 5440 bytes |
SHA-256: 521bab261433cd72acb6a1fa785de5891d96270d151d49b6773a2398e1d353c3 |
|||
font_01_sfnt_off0000fe51.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE51 | 10900 bytes |
SHA-256: 4a2880df8758606d7052b1646143f4dd62f85fd3a9e557f5abd3e22df29299ea |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.