MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF file identified as malicious by multiple heuristics and a machine learning classifier. It contains a significant number of external links, with many hosted on disposable domains, indicating a link farm designed to distribute malicious content. The presence of a URL with a 'utm_term' parameter suggests a phishing or SEO-based lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=aermotor+windmill+tower+assembly PDF link annotation
- https://cdn.sqhk.co/xejudawadoni/vehhlhb/dokuvewuronadesaxovije.pdfIn PDF document text
- https://wedutigumufezeb.weebly.com/uploads/1/3/4/6/134659425/jodudobakoda.pdfIn PDF document text
- http://1xbet-football.fun/90108931871c3rbe.pdfIn PDF document text
- https://cdn.sqhk.co/fetogivaw/heGiegg/40842055628.pdfIn PDF document text
- http://covidcapsule.world/23225490706jx1iz.pdfIn PDF document text
- http://ipatovaalena.ru/crank_ellen_hopkins_free_onlineot4qu.pdfIn PDF document text
- https://noxajigaja.weebly.com/uploads/1/3/4/6/134698193/zadiwoja.pdfIn PDF document text
- http://worldhold.online/morpheme_exercises_with_answers4zufb.pdfIn PDF document text
- https://lugonejiborin.weebly.com/uploads/1/3/5/3/135336075/5dcef.pdfIn PDF document text
- https://cdn.sqhk.co/pabefidinaz/hixk8jc/zanumivaxojimowigofu.pdfIn PDF document text
- https://cdn.sqhk.co/letarezetap/qCFbfIF/free_funeral_program_brochure_psd_template.pdfIn PDF document text
- https://bajorenurelop.weebly.com/uploads/1/3/0/7/130739037/xagirigawatiriguj.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_a0f26182da7e44f79762c69ece510577.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b24e8617-fc63-4bd3-b4c8-07a6a998f50c/beats_by_dre_powerbeats_pro_true_-_wireless_earbuds_-_moss.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f229fea-e887-44da-bb33-632b595113e6/70120490099.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d044002d-1de6-4479-bef1-3d2080098c64/business_secrets_from_the_bible_audiobook.pdfIn PDF document text
- https://7b806e58-2e0f-4c22-b5e1-e0f71c4d6e86.filesusr.com/ugd/8da65f_416a4f0029e84dd6942dd1db35e049d5.pdf?index=trueIn PDF document text
- https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_a62e2a12fd2747d0a74678484b57cab6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b0da2ef2-7ecf-495e-9089-d4f39cf0b3cb/bafufikanozomanop.pdfIn PDF document text
- https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_9c38207dba9042439d40cd774e8b9ca8.pdf?index=trueIn PDF document text
- https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_29bdd801b6ce4cabb09a90072e07d306.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4A5 | 5292 bytes |
SHA-256: 05691cb34e8c702ce103b4188c5035023e19adc730e19b6a743ff8762c003b3f |
|||
font_01_sfnt_off0000f69b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF69B | 11172 bytes |
SHA-256: 23d411177be62a52dfc95c1a2ca2f0cbcea8e51dd3b074407febefe3198314e8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.