MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/strik?utm_term=autocad+tutorial+for+beginners+2020 PDF link annotation
- http://barbanapoli.moscow/consumer_reports_passenger_tire_ratings50y66.pdfIn PDF document text
- http://bridgecommerce.com/gevudakah2nd4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425921/normal_603e19a4b791a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495264/normal_6021e8e645f00.pdfIn PDF document text
- http://ag-management.space/50037781774uz8ka.pdfIn PDF document text
- http://naturfresh.fun/zejaraja4h84i.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://8ed7b8cb-9bae-4def-ad9b-66b28cd11f91.filesusr.com/ugd/740d8c_30a233b1a5fe43bb865543329c3ec6e7.pdf?index=trueIn PDF document text
- https://a24bc4ef-4ee2-4fae-af0c-c9fea810b245.filesusr.com/ugd/67d96c_76cee7eab66d4909a48e140281b43716.pdf?index=trueIn PDF document text
- https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_458e4c82772a49e7be51e299f20b28c2.pdf?index=trueIn PDF document text
- https://32e47638-7206-44c1-ad53-5c6f9176402e.filesusr.com/ugd/e00742_0b7069a78d614bf9801d4ea68170b85f.pdf?index=trueIn PDF document text
- https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_50850f9805234118b32f4ba54149c28d.pdf?index=trueIn PDF document text
- https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_0f1b6ba40a2b4ba7b3d881094005e31d.pdf?index=trueIn PDF document text
- https://95049c82-e412-4913-a0b0-e03e83d5170a.filesusr.com/ugd/127d6e_c4dc894b60064914af2758ffd35dade6.pdf?index=trueIn PDF document text
- https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_3a6100159599401aa45219130521f7e6.pdf?index=trueIn PDF document text
- https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_0f98cbef7fed4e489a13db4a8195ff24.pdf?index=trueIn PDF document text
- https://73af689e-4c80-4f62-99d3-7a886641ad81.filesusr.com/ugd/3b5dd9_fc2a6ca0dc5c40a89e495d227d3d783f.pdf?index=trueIn PDF document text
- https://cb70cc59-2297-49c3-b7e2-2ac7e26e28d4.filesusr.com/ugd/4479ed_7853067151324f04a35a1ce3f51282fb.pdf?index=trueIn PDF document text
- https://da18e6a8-d720-42de-a88c-3f13daad7efb.filesusr.com/ugd/08fe48_e0e56e9899bc4aad9963315e76297318.pdf?index=trueIn PDF document text
- https://6762652a-e869-40f3-960d-1446d4066230.filesusr.com/ugd/55e6b1_753af263723c463b860faf28c847e9e9.pdf?index=trueIn PDF document text
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_303b0393dc144779b0d9396d73364331.pdf?index=trueIn PDF document text
- https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_da6aacdf023c49b7b34579fb57c0ebfb.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000db8a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB8A | 5592 bytes |
SHA-256: c57c96bd0bcf1db7352fdeeab4fc7c7b15141bee8f8dd1668180675fbe920dd7 |
|||
font_01_sfnt_off0000eea1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEA1 | 10708 bytes |
SHA-256: ad8acfb5c5cf102caace59ff1079e3bed7a3f2e827eb95e3d634ef0b564ed449 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.