MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=chup+chup+dekhati+hu+ringtone PDF link annotation
- https://gonibulurigudum.weebly.com/uploads/1/3/0/8/130874364/rifoworowejiget.pdfIn PDF document text
- https://xilasofuvi.weebly.com/uploads/1/3/4/6/134651230/lizewopame_minatogise_sidasadu.pdfIn PDF document text
- https://jugijivarute.weebly.com/uploads/1/3/4/6/134620481/fewegasakipabij.pdfIn PDF document text
- https://cdn.sqhk.co/mopewedote/SRZjbjg/tulegipafunelexagoderivi.pdfIn PDF document text
- https://zaxonuwikujad.weebly.com/uploads/1/3/0/8/130874627/wefogume.pdfIn PDF document text
- http://fujigukatujewu.medianewsonline.com/uefa_champions_league_fixture_2020_20.pdfIn PDF document text
- https://cdn.sqhk.co/wifavizen/hjd5hjC/photo_collage_maker_online.pdfIn PDF document text
- https://rojilijeliw.weebly.com/uploads/1/3/1/4/131409822/5260889.pdfIn PDF document text
- https://kagidawizukafep.weebly.com/uploads/1/3/5/3/135346662/lalijaxe.pdfIn PDF document text
- http://bestpriceforukraine.xyz/giwopfvf77.pdfIn PDF document text
- http://creamspait.xyz/zisolujikiwotikunebur9oh.pdfIn PDF document text
- http://extrameets.fun/38700524187lde7l.pdfIn PDF document text
- http://life-news.tech/elasticsearch_api_get_index_templateojcmu.pdfIn PDF document text
- http://lavkavkusa.store/how_to_apply_for_statutory_maternity_pay_when_self_employedoxx8w.pdfIn PDF document text
- http://zuxekagapefe.mygamesonline.org/charmglow_gas_grill_3_burner.pdfIn PDF document text
- https://cdn.sqhk.co/febenapox/7hbfjjb/wagodabifubunewonakasoji.pdfIn PDF document text
- https://cdn.sqhk.co/kozuvurop/jbBVChe/kart_racing_league_houston.pdfIn PDF document text
- https://cdn.sqhk.co/mepetiruzi/iRJoidR/contract_whist_card_game.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://niwurekatexo.atwebpages.com/8412484173.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53074e3d-84ae-4c70-b155-d62782dab34e/hp_laserjet_4200dtn_maintenance_kit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e82b86a7-40fa-48e5-a1e5-949c4a5e816a/3302469306.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c83f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC83F | 6744 bytes |
SHA-256: b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808 |
|||
font_01_sfnt_off0000d924.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD924 | 5092 bytes |
SHA-256: 0f39cc6b872734902c1c6b66ce0dfce61d9c06496e9411bb15c56bcc48a04402 |
|||
font_02_sfnt_off0000ea70.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA70 | 10844 bytes |
SHA-256: 969bdfb9e2ea10b5b2b6234077632918c31c8e999440c048e2570c2590f2f116 |
|||
font_03_sfnt_off00010f99.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F99 | 16144 bytes |
SHA-256: f6e0f4a25f18a144688c6b7f40519a5efc98c72643b9054f89526e396d9b459d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.