MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable domains, suggesting a link farm or phishing operation. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a spearphishing attachment designed to redirect users to potentially malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/123?utm_term=biosynthesis+of+purine+pdf PDF link annotation
- https://cdn.sqhk.co/nasanoroge/gjieBgg/xozunamotu.pdfIn PDF document text
- https://cdn.sqhk.co/gisepavuv/aXjeWjc/zombie_land_rush_apocalypse_roadkill_3ds.pdfIn PDF document text
- http://tufodudem.mypressonline.com/simple_pencil_drawing_ideas_for_beginners.pdfIn PDF document text
- http://nodozavi.iblogger.org/in_play_store_whatsapp.pdfIn PDF document text
- http://faketikus.22web.org/65484724667.pdfIn PDF document text
- https://cdn.sqhk.co/zepipawetopi/eBjeJhd/transformers_shattered_glass_fanfiction_starscream.pdfIn PDF document text
- http://golivexi.22web.org/fuxemofunidowugubovaxezed.pdfIn PDF document text
- http://vowufijetapiko.sportsontheweb.net/how_to_replace_a_flame_sensor_on_a_lennox_furnace.pdfIn PDF document text
- http://pewekelexu.mygamesonline.org/causas_del_embarazo_adolescente.pdfIn PDF document text
- https://cdn.sqhk.co/pujigaloruri/jf4iaRa/cute_puppy_wallpapers_for_desktop.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://f1c0478e-57b3-422a-b8eb-433964b677d2.filesusr.com/ugd/16c17d_bc40cad4aee24594bd24acab0ea20234.pdf?index=trueIn PDF document text
- https://1416a32c-f91c-4ec3-9c10-bfdf610c7df7.filesusr.com/ugd/76de1a_6251c9660f8342638a07ab903996f0b0.pdf?index=trueIn PDF document text
- http://nudifezidezi.rf.gd/bogedogejejak.pdfIn PDF document text
- https://2cfcb734-ec62-4cd9-b61c-03d4762ad765.filesusr.com/ugd/a891c0_c167207318704a30b50352a8dfe180f3.pdf?index=trueIn PDF document text
- https://17c3d818-7f64-4152-976a-2fa997d7a7be.filesusr.com/ugd/e2c250_4ea870f9f5f34268a27a9b92bcd75bd9.pdf?index=trueIn PDF document text
- https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_7556a55046704a82bd492f5b8ebebd8a.pdf?index=trueIn PDF document text
- https://09235f31-469a-4613-94fc-36d04c1f642a.filesusr.com/ugd/8b6407_8be0483e5be7485dbbf32c7d39681dc0.pdf?index=trueIn PDF document text
- https://8b7199fc-a029-4910-8138-caee300d1cbd.filesusr.com/ugd/da8f68_685e390db5e445dfb3be134ce4a48e96.pdf?index=trueIn PDF document text
- http://risepaxazitomep.rf.gd/adding_integers_on_number_line_worksheet.pdfIn PDF document text
- http://morufigalolo.rf.gd/todas_las_aperturas_de_ajedrez.pdfIn PDF document text
- http://kubomefewofumim.atwebpages.com/gukaguxamo.pdfIn PDF document text
- https://fd0ef26f-7b8f-4c91-b3b2-19f7ec93487a.filesusr.com/ugd/4174bf_b59e60fe932142efb7524c5ef592d10e.pdf?index=trueIn PDF document text
- https://5b3500e9-40b4-440a-9ada-171ed8bcf4c9.filesusr.com/ugd/7820d0_a78acb621a984c4294dab7f0a8858c77.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f74e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF74E | 5036 bytes |
SHA-256: 92e91af98bc98bec53b547117c3c44f260829a52a532bf549577b68bc34d5e71 |
|||
font_01_sfnt_off0001087a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1087A | 11188 bytes |
SHA-256: 2a54ccbc8e380c063423b633b8ef99f8189786f4323bd78c19944ab6939b9c1d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.