MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of external links, characteristic of a link farm or SEO poisoning attack, aiming to direct users to potentially malicious websites. The document body, though heavily obfuscated, appears to contain keywords related to educational materials, likely as a lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.8379
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/award?keyword=writing+and+balancing+chemical+equations+worksheet+answers+pdf
- http://xazamobi.66ghz.com/keysight_oscilloscope_programming_guide.pdf
- http://redarirot.iblogger.org/17270160026.pdf
- https://cdn-cms.f-static.net/uploads/4466143/normal_602b5ac34adf2.pdf
- http://motorutovibipe.sportsontheweb.net/pivoporurujenagiwet.pdf
- http://degakak.sportsontheweb.net/gubuk.pdf
- https://static.s123-cdn-static.com/uploads/4475864/normal_5fd08a4e680e6.pdf
- http://fegalaro.iblogger.org/who_destroyed_the_temple_in_jerusalem_the_first_time.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://9de673a2-3b8e-40eb-bbf5-c0ad8e71a3da.filesusr.com/ugd/bd5c68_bb77ee971c264372ae746716d4999cdc.pdf?index=true
- https://2e4d99de-9d37-4ce2-abd5-0bbccafdbe51.filesusr.com/ugd/33a2e4_ea15ce316b004d16ada979f888c87800.pdf?index=true
- https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_f674c7b289aa408890168fe087a863d0.pdf?index=true
- https://uploads.strikinglycdn.com/files/7f5673e1-3eb4-41ec-91d3-e392c0029a64/85600837337.pdf
- https://45e41439-46a4-4c97-84f0-155cfeda4cef.filesusr.com/ugd/9d7ad9_6d087fb284d54ccd8410593f96963536.pdf?index=true
- https://a6132035-7465-4fe4-be4e-2faa96c22dab.filesusr.com/ugd/cf950b_c55994e4ce6f4ce99f5892d6fcc2d0a0.pdf?index=true
- https://08c3cc13-1ce0-4add-927e-a3aed263473e.filesusr.com/ugd/ccf397_99c56b28c7c749af84fbc605afefec90.pdf?index=true
- http://witesenigo.atwebpages.com/syma_x8g_camera_not_working.pdf
- https://43a2ba88-5de9-465b-b95f-6a4d82f2d06e.filesusr.com/ugd/dcbeda_078d1dc78384492682fd87ed6eaebef6.pdf?index=true
- https://uploads.strikinglycdn.com/files/20fcf88b-c81a-4817-9e29-a20815fec915/polytune_2_mini_always_on.pdf
- https://2d2b1dae-c014-4902-97e6-c3f1d56915cd.filesusr.com/ugd/70e5f7_57a7778d646c4c50a2240daad96e6eb5.pdf?index=true
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e725.binab3388e7fcad7033243348791b4905eae7dc9ba0f1eb037bea213fdb1169f452 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE725 | 6004 bytes |
font_01_sfnt_off0000fb7c.bin4e942e1606a48663a0b250c992cfe2452d09de4461c598f1520d5761010e9259 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB7C | 10676 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.