MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=scary+stories+to+tell+in+the+dark+3+harold+pdf PDF link annotation
- http://iuts.space/what_are_the_best_wireless_sport_earbuds3mjxt.pdfIn PDF document text
- http://golomashvanna.xyz/s20_fe_vs_s9_sizewy8bd.pdfIn PDF document text
- http://english-10.site/feveleroxariri9dlju.pdfIn PDF document text
- http://emmetrix.net/66890482764dfca8.pdfIn PDF document text
- http://zespodsvetkoy.site/xeduzepubumie7uz6.pdfIn PDF document text
- http://infonewsuk.site/how_to_repair_a_delta_shower_handlev0toh.pdfIn PDF document text
- http://helpcenterbusiness.xyz/motorola_barcode_scanner_carriage_returndr2cq.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480588/normal_60394c910a6bd.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4504788/normal_60064ed8af95f.pdfIn PDF document text
- http://wwwbcpzonasegura-viabcp.com/how_do_i_reset_my_apple_time_capsule_to_factory_settingsr7zmw.pdfIn PDF document text
- http://magnetfix.store/tiktok_video_download_without_appsfpai.pdfIn PDF document text
- http://afracheat6.xyz/igcse_maths_formula_sheetdkfrr.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://3c59ccad-08dd-474b-8af0-a42d91f20399.filesusr.com/ugd/489ff0_7bc1b713ec0a49c4b025c46da1814e0a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7fca3ef2-7cfe-4ef1-a8ae-1f27ba84cacd/problemas_sociales_en_mexico_actualmente.pdfIn PDF document text
- https://eaae50f7-3b1c-4f1b-9b3c-e2a48377569d.filesusr.com/ugd/b96e41_6e45e7ea36aa4491b456d1eb70f2a239.pdf?index=trueIn PDF document text
- https://f5071db7-799c-4807-8cfa-c66b012f33b1.filesusr.com/ugd/9a4546_7714b8b5a8c947c4bc0f7a38ed46fb6d.pdf?index=trueIn PDF document text
- https://1138278f-e8d0-45ef-aef3-dbdd7428ac52.filesusr.com/ugd/5be868_4411479fcda046f5b460142ead5f4d81.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b9cf9b9c-242b-4262-a67b-4cb5f50fcd0d/best_stock_exchange_in_the_world_today.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50b03c5f-90b3-4c9c-a902-a636b65d7dd5/79742932109.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9fe799c1-1358-4894-be81-1d1b7ee88227/how_to_practice_lent_catholic.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7ea2d8c-39a4-47a7-9875-adbde8d13b71/80108692261.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7af35c74-ca46-4384-af17-dcb6a90553f8/pumonaladagesesuze.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/793b26a6-5014-4cec-a00e-16b6c786c50f/mental_status_examination_sample.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f9eb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9EB | 5676 bytes |
SHA-256: 236849c76c90c90a997e93f89518e15807c75af953f37ae56495e19d9ea89f6e |
|||
font_01_sfnt_off00010d44.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D44 | 11180 bytes |
SHA-256: 62b6d298e1b1be8f24fbccc46de976d3397ce626bb5721f930a16ed6192daea9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.