MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, identified as a link farm. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically related to phishing. The embedded URLs, such as 'https://dugedepap.ru/strik?utm_term=taking+sides+clashing+views+on+psychological+issues+20th+edition+pdf', suggest a lure to download further content or engage in phishing activities. The document body is heavily obfuscated and contains metadata from wkhtmltopdf, indicating it was likely generated programmatically.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=taking+sides+clashing+views+on+psychological+issues+20th+edition+pdf
- https://xiluruzubu.weebly.com/uploads/1/3/0/8/130813732/larupafu.pdf
- https://dewufore.weebly.com/uploads/1/3/4/8/134857007/nunafaselebisowapin.pdf
- https://lalidusuferub.weebly.com/uploads/1/3/4/4/134440540/fomikuregudobe-raletolemutigi-jonilanupulan.pdf
- https://bujupovira.weebly.com/uploads/1/3/4/4/134472582/7e32fc19194b.pdf
- https://lesejudojava.weebly.com/uploads/1/3/1/1/131164013/zajegavunivaviv-zevoripiban-jumufafusurunum-kodezikugiman.pdf
- https://waxevinibiwe.weebly.com/uploads/1/3/0/9/130969944/8484156.pdf
- https://ditaluli.weebly.com/uploads/1/3/5/3/135325413/nezomobovokowi.pdf
- http://sosujinoriwi.22web.org/litimemo.pdf
- https://funogefoxareso.weebly.com/uploads/1/3/4/0/134041001/2183789.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_c44327e1731b4c108ebac3a440b12cca.pdf?index=true
- https://599b09cd-7b6a-4758-94a3-08a08d316165.filesusr.com/ugd/628a76_1e9c67662727426f94598d0b3b23a4df.pdf?index=true
- https://0f424234-9c27-4462-a606-4b2ccecf17d8.filesusr.com/ugd/b42a09_6e63ab7a5d10468b9a7c7cd4c46b8f36.pdf?index=true
- https://bc3ee532-4344-4262-9f0b-d8353e2229a5.filesusr.com/ugd/6ca3f6_5b369b0d05a6429e949b6a0fd2e9e0a3.pdf?index=true
- http://jirirobow.epizy.com/obc_application_form_download_in_bengali.pdf
- https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_2c0658e180c2453794d36cc21f6f159d.pdf?index=true
- https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_6d31fea1b2ad4a029fdb550d69f3ee86.pdf?index=true
- https://uploads.strikinglycdn.com/files/25194d9b-f318-47f5-b73c-8ea33e00f015/lincoln_electric_ac225_stick_welder_k1170_reviews.pdf
- https://uploads.strikinglycdn.com/files/1958261a-758b-45a4-b233-b0a32ceafce0/intermediate_accounting_11th_canadian_edition_volume_2_chapter_14_solutions.pdf
- https://uploads.strikinglycdn.com/files/cb198de0-5783-4fb0-b3a1-2237be0146f4/wisop.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000123d8.bin82a9b171e0c46e9c761d87c46119ae05c6ccf34a2a6bf19e6b1b5745418401e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x123D8 | 5860 bytes |
font_01_sfnt_off000137f0.binfb688efdc1ec490ca2a7329962d22f88012b1f720199daa01bd2fc587ccc4e18 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x137F0 | 12196 bytes |
font_02_sfnt_off00016108.bin31aa257675234f953cb39254c73a0c002637764ec2691c470e0912636c3685cf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16108 | 16204 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.