MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file exhibits characteristics of a phishing lure, specifically designed to appear as a 'capital structure pdf download'. It contains a large number of external links, many of which point to other PDF files, suggesting a link farm used to distribute malicious content or for SEO manipulation. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=capital+structure+pdf+download PDF link annotation
- http://juvovagesubo.mywebcommunity.org/waring_food_dehydrator_model_11df21_manual.pdfIn PDF document text
- http://fekevopimibun.sportsontheweb.net/sokefuwalefup.pdfIn PDF document text
- http://wuwudikosegukem.mypressonline.com/98464279310.pdfIn PDF document text
- http://budokudepa.scienceontheweb.net/geometric_mean_theorem_worksheet.pdfIn PDF document text
- http://fadulifakibul.medianewsonline.com/81428045338.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://ab9101c8-a046-40a0-ba79-761bab9f3367.filesusr.com/ugd/61fb7c_12304caa7c9540a9ac8eb331c1fbfd45.pdf?index=trueIn PDF document text
- http://padusij.onlinewebshop.net/the_taming_ofthe_shrew_modern_english_translation.pdfIn PDF document text
- https://s3.amazonaws.com/kujesulad/tamilplay_com_2018_movies.pdfIn PDF document text
- https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_d66a5996cde64f558ff8447769475935.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dazuxujepov/the_long_way_to_a_small_angry_planet_read_online_free.pdfIn PDF document text
- https://d70b1dc8-7d09-4148-9854-e6a7cae1b87b.filesusr.com/ugd/5899d5_5e76915d5bc64fec92a2169cbec8e63b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zobuwubedak/fluid_balance_chart_guidelines_australia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/075c0cee-d56f-432b-9c2d-30f17f6e499e/examples_of_text_structure.pdfIn PDF document text
- https://20128683-61eb-4207-b985-d468b1a81fea.filesusr.com/ugd/0049ca_67929f866cba4616a98c94014a733ea9.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sivanira/burning_bright_hollywood_movie_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77a4cd1b-315a-425c-97cf-2e61d2d66760/lord_of_the_rings_characters_full_names.pdfIn PDF document text
- https://s3.amazonaws.com/sulasatevirexo/xakutafelexas.pdfIn PDF document text
- http://zevesijuduma.atwebpages.com/health_and_safety_officer_salary_ontario.pdfIn PDF document text
- https://s3.amazonaws.com/votuweroxigezog/oral-b_pro_5000_smartseries_power_rechargeable_electric_toothbrush_with_bluetooth.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4cd9a448-7985-402f-8e3a-5aac5131646f/8500693147.pdfIn PDF document text
- https://s3.amazonaws.com/timeziso/renujezuxonarom.pdfIn PDF document text
- https://1b6a1bbc-c127-422b-858f-c975555fd18f.filesusr.com/ugd/31f47c_d86df8541ccd4cc4b70d96d3c081e6ff.pdf?index=trueIn PDF document text
- http://nisetekotixob.myartsonline.com/present_perfect_continuous_esl_activity.pdfIn PDF document text
- https://s3.amazonaws.com/lemerisinivum/apple_watch_4_band_size_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e462.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE462 | 5148 bytes |
SHA-256: a2944277004a4485401f06271b421ee555caf8c95e95b2ca6585656e8d305c18 |
|||
font_01_sfnt_off0000f600.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF600 | 10576 bytes |
SHA-256: 2d30228b38b91df133a85cce6f9865ba83c2545e01e846628dd5d6e5914917f6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.