MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9956
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=systemverilog+unique+case+%25281%2527b1%2529 PDF link annotation
- https://cdn.sqhk.co/gixegusu/cwegmKs/talupibi.pdfIn PDF document text
- http://nunobuzipame.medianewsonline.com/vuwiluji.pdfIn PDF document text
- http://fawikenaxalu.scienceontheweb.net/husqvarna_450_chainsaw_carburetor.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466675/normal_5fdab4f3dc8fc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454286/normal_602dfde380af3.pdfIn PDF document text
- https://zipuwuxa.weebly.com/uploads/1/3/4/3/134376087/7319788.pdfIn PDF document text
- http://itfamily.info/video_player_for_mac_os_x_10._6081kv.pdfIn PDF document text
- https://cdn.sqhk.co/mofijovelu/Y4NjbEp/zusubobidunopenedosu.pdfIn PDF document text
- http://omoikiri.info/husqvarna_lawn_mower_manual_hu775hdcdoc.pdfIn PDF document text
- https://diwoneguni.weebly.com/uploads/1/3/1/4/131407083/xafizovuvume.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4501198/normal_5feb1e5441526.pdfIn PDF document text
- https://fuxovibafisiboj.weebly.com/uploads/1/3/0/8/130874455/3e9bc24ab.pdfIn PDF document text
- https://rupilobeva.weebly.com/uploads/1/3/0/7/130775598/70204.pdfIn PDF document text
- https://cdn.sqhk.co/mugegiduveb/h2Djihf/color_splash_background_hd_png.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478932/normal_60299a843fec2.pdfIn PDF document text
- http://tuimag.ru/fusoxidareki661t6.pdfIn PDF document text
- https://dodonixufaf.weebly.com/uploads/1/3/1/4/131453867/49ec99b3a82ad.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444123/normal_5fd8783f89c8e.pdfIn PDF document text
- https://cdn.sqhk.co/sugojipo/uieNieb/pencilmation_youtube_revenue.pdfIn PDF document text
- http://sewukagazub.mypressonline.com/jelipitujumelegamivomi.pdfIn PDF document text
- https://cdn.sqhk.co/resozasevej/7VZgh3E/97545218643.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/42fd5049-e872-40b5-826b-171a42e235fd/costo_software_adobe_premiere_pro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/514b6c2e-40a6-419b-a1ab-cb54ad4fd39b/53533003935.pdfIn PDF document text
- http://bogalibamadom.myartsonline.com/vutujozunumogafaradeban.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/21783f4d-bd7e-4dab-8e85-a6ca90f82221/gimagelekivit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6e39f211-ab11-44cf-85f8-4571b1caacef/vupijifegameruzelow.pdfIn PDF document text
- http://gozenabuzixi.onlinewebshop.net/xogopovajalusevixud.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e824.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE824 | 5888 bytes |
SHA-256: d7b66c044ea0029c9db2a0eae6473cff42f303d2542b429dcf1f1634ada317d2 |
|||
font_01_sfnt_off0000fc42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC42 | 11820 bytes |
SHA-256: 9441a47358aff477dc2c39ff02b9e82751066b03108c936eaf6de2bb11326414 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.