MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=what+do+economics+mean+by+scarcity PDF link annotation
- http://cheapestshop.xyz/topstore_download_for_android91db4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367941/normal_6045f57c09949.pdfIn PDF document text
- https://cdn.sqhk.co/rifojimuna/egcW4Lh/motu_patlu_colour_changing_camera_episode.pdfIn PDF document text
- https://cdn.sqhk.co/tevenijubuso/gijiOIg/outbreak_meaning_in_urdu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4486356/normal_60215a432e511.pdfIn PDF document text
- http://particuliers-societegenerale.xyz/how_to_properly_use_a_hair_dryer_diffuserhc3yu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365591/normal_6057023d55d7f.pdfIn PDF document text
- https://cdn.sqhk.co/saseponirifa/jc51giq/bus_rush_game_free_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470028/normal_601582d94ad2f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393346/normal_602a79be985cc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465136/normal_606a10c533b5e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_973fa6427193428ca66574796b35c873.pdf?index=trueIn PDF document text
- https://2903667b-e544-4972-ac7f-e5855aaa9b37.filesusr.com/ugd/2cc660_94d8e5b027554227bb20d116457958b7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ed51b114-fa2c-451d-bf28-64f61e04452a/ford_e350_service_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1033d2c5-d014-4f05-ba8a-b813bc2362e5/ascii_table_c_program.pdfIn PDF document text
- https://05e27880-d5e1-4d3d-8428-ba943e9300bc.filesusr.com/ugd/b56239_cc81fc4f9a5147b481a34e3bbad7b3a4.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ab1bfe3f-4915-42ff-b67a-320fe0f95d45/zixuxenezawodaxe.pdfIn PDF document text
- https://1f53f175-067f-4140-b001-f66bebc9855b.filesusr.com/ugd/c711d8_0f6f8ef8414b4ef1b5140dd9c177a8f5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0c5b0e2d-3f14-4269-bd01-f7d140e85580/70751735881.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b957ca5a-1b69-444e-81ed-8a333f5f07df/7245867022.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e54d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE54D | 5400 bytes |
SHA-256: 5bd34c8ed52c38af4b4c38e195133652cd41c6753697e11553a0276bbe5f6237 |
|||
font_01_sfnt_off0000f790.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF790 | 10748 bytes |
SHA-256: aa1f9a3e8522efa710579d1dd63a929f3b0c067bf44ed74978aef3e5b75588e0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.