MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=steps+to+opening+a+chick+fil+a+franchise PDF link annotation
- http://lozomaneje.getenjoyment.net/analytical_biochemistry_and_separation_techniques.pdfIn PDF document text
- http://nuxuzuruguli.mypressonline.com/54196529023.pdfIn PDF document text
- http://mizifasurogik.mywebcommunity.org/allowances_exempt_from_income_tax_u_s_10.pdfIn PDF document text
- http://bamirajewenexo.medianewsonline.com/tolujuvuzigomebawoziborag.pdfIn PDF document text
- http://lenusabipowezo.getenjoyment.net/lixidijuxasepudo.pdfIn PDF document text
- http://tonedomopoja.scienceontheweb.net/buwogimikifojavopaj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/18dc211f-6aa3-47db-9924-3e09413f5c84/16150343952.pdfIn PDF document text
- https://s3.amazonaws.com/levovod/38145256962.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5316fa5d-e5d2-4424-a9e0-45b7589b5e84/navy_training_base_in_texas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66300ad0-54c5-4d8f-b37d-44a883806172/56387948524.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/261494ad-879c-46da-8e53-7a1a33015535/wujoxarefazekidonexutaj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/544b74a3-fb1a-4133-91ad-0ef074f6ed6c/lugefikib.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/95b0cc5d-fb34-4ac6-9edc-986a9be7f301/68487394186.pdfIn PDF document text
- https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_74cbf90a5399425182884365295b20f5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jemisajoda/tujurupebe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93b43a7a-58fb-4a29-a850-30d867117602/tfs_2015_requirements_sql_server.pdfIn PDF document text
- https://s3.amazonaws.com/rudelazifizuvo/2151775704.pdfIn PDF document text
- https://e4c06157-4c4c-4c30-848d-1ce07482e123.filesusr.com/ugd/99e070_c04745ee6d6b45559a2ae2b8f76c4147.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3e57574e-c2f7-44de-881c-12f496da6544/55139937544.pdfIn PDF document text
- https://s3.amazonaws.com/gadumagabusodel/england_rugby_match_report.pdfIn PDF document text
- https://s3.amazonaws.com/nafoxuda/88249606491.pdfIn PDF document text
- https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_7fefdcb7a6bb4172a075089c452ccf32.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015ec3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15EC3 | 5444 bytes |
SHA-256: 969acd35b798f38b93b9227cd08337dd1cedda85b039cae1d72aacfc2b1516b5 |
|||
font_01_sfnt_off00017144.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17144 | 11700 bytes |
SHA-256: 867411f72a69852204f188f96b9e4f84874b6e6b257fcdfb083db7cd26d47f10 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.