MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/wix?keyword=danny+phantom+sad+fanfiction PDF link annotation
- http://lijijuzopos.iblogger.org/moragopiliw.pdfIn PDF document text
- http://watodakazo.22web.org/bosimotilipixamesube.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b33a0217-25d3-4bbe-a156-2d090e2812ee/honda_hs520_snowblower_oil_capacity.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/633a90fc-0337-4959-8907-3b823160d7b9/29397972256.pdfIn PDF document text
- https://50b44c92-959e-4a15-bf83-93d6b2b518d6.filesusr.com/ugd/3ed44c_9d35d707f5da495a86b2e2fbdb45a268.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1691668a-670d-40fb-ab70-15e7d116eb38/pefami.pdfIn PDF document text
- http://tuxizosog.rf.gd/volume_of_a_cuboid_worksheet_gcse.pdfIn PDF document text
- https://62abf401-5fc9-4991-ac00-cb6a0c8cf8ec.filesusr.com/ugd/e4ff69_8d04cb7cb271447f84458ca69055738e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zedudo/cisco_email_security_virtual_appliance_installation_guide.pdfIn PDF document text
- http://wulimazef.epizy.com/ben_10_games_free_for_pc.pdfIn PDF document text
- https://s3.amazonaws.com/tuxenipup/what_are_the_4_types_of_biomes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee6ca0cb-659c-43fc-a9f7-e26dc51faf08/99728949702.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81f3c2f6-5678-4268-83a0-02cc614f3599/small_appliance_repair_service_near_me.pdfIn PDF document text
- https://0d555108-1732-4721-8d72-76d747b2053a.filesusr.com/ugd/1b0481_135c85e8c6fd4e69bfe41acc8f17a89c.pdf?index=trueIn PDF document text
- https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_dac0c0edfd444447ab1e32805600bac4.pdf?index=trueIn PDF document text
- http://ditufadupogeju.epizy.com/55988012226.pdfIn PDF document text
- http://kidaxuv.epizy.com/appleseed_ex_machina_mp4.pdfIn PDF document text
- https://s3.amazonaws.com/rikolesafuwofar/matlab_plot_title_underscore.pdfIn PDF document text
- https://s3.amazonaws.com/mokixetat/how_to_read_the_bible_for_all_its_worth_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3c8a756-4b41-4d39-91c1-e2fa07caf475/51931668429.pdfIn PDF document text
- http://pukokudew.epizy.com/45934815539.pdfIn PDF document text
- http://bonizeza.epizy.com/6811273132.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3e0be74-a2d4-4d75-8618-50af6d41e65c/fobufuzususu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea28.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA28 | 5368 bytes |
SHA-256: 16081ac1a5fda247cfed481d9d4e2f1710f167fc39a5cbdd08ce0c82d46f990a |
|||
font_01_sfnt_off0000fc5d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC5D | 10800 bytes |
SHA-256: 7f5754e1c35736e30fb32519fcb554363442e461f47eaacdba63ca6492077b39 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.