MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by multiple heuristics as a link farm, containing numerous external links to other PDFs hosted on various domains. The ML classifier and ClamAV also identified it as malicious, specifically a phishing trojan. While no scripts were extracted, the presence of many external links suggests a phishing or SEO manipulation attempt, likely delivered as a spearphishing attachment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/award?keyword=b.+ed+entrance+exam+syllabus+2020+pdf PDF link annotation
- https://labuxodapiju.weebly.com/uploads/1/3/4/4/134492440/neguworovug_pajowarepez.pdfIn PDF document text
- http://barekokodigak.iblogger.org/best_personal_finance_app_android_australia.pdfIn PDF document text
- http://datekal.22web.org/amex_corporate_card_application_form.pdfIn PDF document text
- https://jurozujuzofu.weebly.com/uploads/1/3/4/8/134875655/1604170.pdfIn PDF document text
- http://zomoxesami.22web.org/does_ford_ranger_come_in_4x4.pdfIn PDF document text
- http://gonugotez.22web.org/billetera_movil_carnet_de_la_patria_apk.pdfIn PDF document text
- https://xuzubakew.weebly.com/uploads/1/3/0/9/130969304/sowefino-kogerawizapoxug.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/801c3d00-56c4-4eeb-ab1c-5606ecdb05de/10995388845.pdfIn PDF document text
- https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_c5fd0df1063d4f079e2e4b9dbe5896c9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/40af6051-68b1-499d-83cd-7680c5272195/47372082280.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bea70992-0b17-49d8-a5c1-741266b57131/35311161130.pdfIn PDF document text
- http://jixonolalosixew.rf.gd/kexebubuferijojagunudi.pdfIn PDF document text
- https://bb74f61c-7045-47bf-9a7e-968101ee373e.filesusr.com/ugd/81ef4b_18502b3dfa59499aaa046ed46d384210.pdf?index=trueIn PDF document text
- https://5c90cfa9-af55-48e2-9430-1f3580382729.filesusr.com/ugd/e2b09b_2a69df9abb944e98b193b66ff28c8643.pdf?index=trueIn PDF document text
- https://810dce77-56ab-4324-823a-3549757f4eab.filesusr.com/ugd/1fad07_e4c012d21a4e4063b008352fc9dca29c.pdf?index=trueIn PDF document text
- http://suwulinivez.rf.gd/15575085994.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c9b4dc40-61fb-4df2-a9e0-4b507eef659a/bamawa.pdfIn PDF document text
- http://wemosoxa.rf.gd/holland_code_careers_list.pdfIn PDF document text
- http://xojifelogumexe.rf.gd/angina_de_pecho_diagnostico_y_tratamiento.pdfIn PDF document text
- https://2e03c77f-99cc-4591-9807-54d8d49c9ce6.filesusr.com/ugd/759733_6a5d7e83679b4348b2ced22c3c75f007.pdf?index=trueIn PDF document text
- https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_a2f9395cc85d41d99dba6095df518cc2.pdf?index=trueIn PDF document text
- http://vufobaratoja.epizy.com/19020661600.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2ab00e5-4ad1-467d-aa66-7a650ea3f39f/31772508172.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f277.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF277 | 5964 bytes |
SHA-256: b8431190ca563d4ada998433fb6de34608fc98332ce32f14b63623b8b3a32d76 |
|||
font_01_sfnt_off000106be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106BE | 10840 bytes |
SHA-256: bbf5eba6d7f5b0e25970e8057a8fc24036675d07f987f6d17b62ab0c00d4d323 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.