MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/strik?utm_term=aa+traffic+in+my+area PDF link annotation
- http://xosukesodur.22web.org/juxufomukejatomifewilu.pdfIn PDF document text
- https://jowatewiko.weebly.com/uploads/1/3/1/3/131380225/dazofawezidot.pdfIn PDF document text
- https://jivetigaforivuj.weebly.com/uploads/1/3/4/3/134350389/lupofikig-dejoretifevigo-mizaduji-pedijomonireja.pdfIn PDF document text
- https://rosanuwafurix.weebly.com/uploads/1/3/4/7/134766820/ruvage_rakogesarixom_gobusazuvakub_wonijaxazaka.pdfIn PDF document text
- https://gavojaxuwutik.weebly.com/uploads/1/3/4/3/134319320/mafifo.pdfIn PDF document text
- https://ziwagunu.weebly.com/uploads/1/3/4/8/134883986/1825486.pdfIn PDF document text
- https://wonakusoxenim.weebly.com/uploads/1/3/5/3/135340368/zojoxuji.pdfIn PDF document text
- https://dukopovofozevi.weebly.com/uploads/1/3/5/2/135295758/c856ebd.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://1f2f8e77-98df-4c5e-b88a-83bc2b612b58.filesusr.com/ugd/5c7528_74f2f321d5c641c0bd322db4fd69f247.pdf?index=trueIn PDF document text
- https://e6c529cc-411f-4195-b5ea-7b5fd081490a.filesusr.com/ugd/b7ab08_e78fceb6e7334b3c8c3acd814bb52912.pdf?index=trueIn PDF document text
- http://jusarif.rf.gd/jevulefiguzisajak.pdfIn PDF document text
- https://48e4e0df-78ce-4736-8797-27735e68dc67.filesusr.com/ugd/f3b179_ad40c11f927a4824961be7968f09f7d2.pdf?index=trueIn PDF document text
- https://08202b68-adf4-4b7d-bb06-fcebe54c78b8.filesusr.com/ugd/76dd3d_2fd8cbdae7da4e2fb659b89e7c5bb659.pdf?index=trueIn PDF document text
- https://00c0516a-c822-4344-a779-6f74e039753d.filesusr.com/ugd/9e41f0_0ed5dea95c264e708f14c7d4a3555bd6.pdf?index=trueIn PDF document text
- https://7835c217-6b95-46a1-915a-76cdebae3fe0.filesusr.com/ugd/debfb4_0f482c9b0fbb42419931c296e24f685d.pdf?index=trueIn PDF document text
- http://molijogur.epizy.com/62312848004.pdfIn PDF document text
- https://57933e30-1e86-4cbe-ad2b-777cb72f9932.filesusr.com/ugd/235f1a_5f1a5139315a44aab42828ada9434416.pdf?index=trueIn PDF document text
- https://cb8582fb-ab29-4f13-bfd4-623ca244ab52.filesusr.com/ugd/d61b30_28c5e6976c514b208f5b94d3ab69e906.pdf?index=trueIn PDF document text
- https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_26ce1d3202b84e6ebd725eddcf5bd44e.pdf?index=trueIn PDF document text
- https://6eed613e-cbae-405e-b458-9655ef9033f8.filesusr.com/ugd/e4f6f0_ebc05e94d4f34b9590cdf0aecbee59c0.pdf?index=trueIn PDF document text
- https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_81bc0d29630441c5bc826572ea9a181f.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed2d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED2D | 4908 bytes |
SHA-256: 23757eaf952ab5a8e8e8a10bdb6a4a215ba796f61494a7e2a3ae5fbd0281c28f |
|||
font_01_sfnt_off0000fdd7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDD7 | 11988 bytes |
SHA-256: 45c83dea9b4c8b5c4a9fcb8e8ebdb04f73645fb0577ca9438978d8fc8fc0c317 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.