MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, identified as a link farm, with many pointing to disposable domains. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' indicate a pattern of creating numerous links to potentially malicious or spam content. The presence of an embedded URL and the ClamAV detection as 'Pdf.Phishing.Trojan' further support a malicious intent, likely for phishing or distributing further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/wix?keyword=naming+alkynes+worksheet+pdf PDF link annotation
- http://ig-copyrightnoticehelp.com/abbacchio_joins_the_kicking_meme_templatepzhag.pdfIn PDF document text
- https://pibefabetanob.weebly.com/uploads/1/3/4/3/134376782/wafupuduz-xifunemu-xiduguvokejaduw-negutejotiwuxe.pdfIn PDF document text
- https://gikanirirexenad.weebly.com/uploads/1/3/0/7/130776133/gulimolomipub.pdfIn PDF document text
- https://pefeluleno.weebly.com/uploads/1/3/4/6/134698673/lipuwu_koxunukakulikor_dedajip.pdfIn PDF document text
- https://tegeluvosuvu.weebly.com/uploads/1/3/4/8/134873603/turonafajawibodis.pdfIn PDF document text
- http://maturibcgj.space/xalusogwtwr.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/xuzed/setekikevigul.pdfIn PDF document text
- https://9f503c4c-bf14-4dcb-9a7a-68e0e5bb3568.filesusr.com/ugd/8ac1ab_1fd1d07a9c6e4910a2f64cd89165694d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lomuper/zemowanuwupexukemegugo.pdfIn PDF document text
- https://s3.amazonaws.com/dazovosugev/pufuxotusakirumowidawigi.pdfIn PDF document text
- https://77bc4ea4-de20-41c0-a463-a5315db628d9.filesusr.com/ugd/2c69e3_87945eb22b6a4cb9bb5b7dc4ad2e1f80.pdf?index=trueIn PDF document text
- https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_5c4d23f7fd2e4b579a33f57f56c60924.pdf?index=trueIn PDF document text
- https://06b91503-bda4-4bbd-a69c-520552d4e402.filesusr.com/ugd/07c5d0_7a77f462a3c44449ae22bf755a86ecd3.pdf?index=trueIn PDF document text
- https://67bb8873-ca08-4da4-87c0-60a8072ebff6.filesusr.com/ugd/a838c0_d68c9de5b3c94376b759f71ca5208fbc.pdf?index=trueIn PDF document text
- https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_cc324f944499493b8254c7843b42cc62.pdf?index=trueIn PDF document text
- https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_ae2d7ea4cd88435ca3ed0954ed575fc3.pdf?index=trueIn PDF document text
- https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_a2d796a39b7145be999591121ce09606.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e610.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE610 | 5680 bytes |
SHA-256: c5980b59d3e473e342a443d6741b4c3c2aad0fdc593aaa1725a8957db214de32 |
|||
font_01_sfnt_off0000f95e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF95E | 11968 bytes |
SHA-256: 402fdde1d9c75914685f4e7685c3c8500fca3a2303ff803e14a766e8c713b29f |
|||
font_02_sfnt_off00012251.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12251 | 16248 bytes |
SHA-256: 7f10b5217708b7aced76a9c7cd02a51188d2af7235ea23585d094f6560042d0f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.