MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by both ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains a link farm with numerous external URLs, many hosted on disposable domains, suggesting a phishing or malware distribution scheme. The presence of a URL with a 'utm_term' parameter related to downloading a vocabulary workshop PDF further supports the lure aspect of the attack.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/strik?utm_term=vocabulary+workshop+level+a+download+pdf PDF link annotation
- https://musisemikalig.weebly.com/uploads/1/3/4/6/134694348/jamibez_kekejajemow_gibevenowotafaz.pdfIn PDF document text
- http://qwertyujg.xyz/74905453629s6ayz.pdfIn PDF document text
- https://zapojejomelaxi.weebly.com/uploads/1/3/0/7/130775516/ragude.pdfIn PDF document text
- http://heartcenteredequestrian.com/sazasetasure3trij.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4475729/normal_5ffa03a26a6d1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4531626/normal_600faf3ae852e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482882/normal_6048d13742ef1.pdfIn PDF document text
- http://rrrrkkkkk.space/46211930983elml3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4bc6dc99-68a2-4627-9f2a-5910c6afbc3d/2005_honda_crv_manual_transmission_fluid_change.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a156d37-326c-4419-94a7-9369e4018e11/how_to_know_when_to_replace_record_player_needle.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5194254-0069-4bf6-a631-2f6695e55b78/resumen_libro_nada_de_carmen_laforet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee541ad2-ebbb-41bf-9108-604f5cb639e4/ib_biology_command_words.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d41a898-75aa-4310-a197-4d4f269ccf11/how_to_use_airplay_2_on_roku.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0c9d1938-5865-4550-8a30-ddc2964c5af8/woxado.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5baafd56-4b2b-4c08-9640-202b46ed2ff8/98349126683.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4208b435-dc98-4a9f-a156-61795bfd61a1/gran_turismo_6_ps3_cheats_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25a04320-d6cc-41c2-a25a-8cc37f3b0bef/31252202117.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/085d01f2-f29a-49a2-804d-89056895fdbc/resistor_color_code_racist_rhyme.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38f0c479-658d-4e9f-aa0b-ce79a62230af/xiruselawun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d416a625-268e-4e0b-8a00-09877cf19ad1/phb_finest_songs.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010adb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ADB | 5668 bytes |
SHA-256: d9732fe1d9c44f06471b9e4c85dc2cdbd6a77eeaf84132e5eb4e3508306681a9 |
|||
font_01_sfnt_off00011e39.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E39 | 13724 bytes |
SHA-256: 608f3ec7e9250a5d3483834c566a0e501b1efaef7b8eb7ae840f0fb2e668be2c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.