MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable hosting services, suggesting a link farm or phishing operation. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URI heuristics point towards a malicious document designed to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/strik?utm_term=program+genie+garage+door+opener+remote PDF link annotation
- https://lovalizivida.weebly.com/uploads/1/3/5/9/135990258/mijefinowarim_pixufizavip_misiziwivodu_nujawi.pdfIn PDF document text
- https://davijonixumitu.weebly.com/uploads/1/3/5/3/135349017/nunenu_baxagexonujal_soruti_zutolog.pdfIn PDF document text
- http://milafikolume.iblogger.org/sorumilerisowipas.pdfIn PDF document text
- https://midunufi.weebly.com/uploads/1/3/4/3/134387712/cb72b1e.pdfIn PDF document text
- https://kelebewo.weebly.com/uploads/1/3/4/3/134359650/5e0e77b.pdfIn PDF document text
- https://cdn.sqhk.co/muvotugi/idB5gfI/pitanadug.pdfIn PDF document text
- https://pabedowilopore.weebly.com/uploads/1/3/1/1/131163579/wujazinizitadejudeba.pdfIn PDF document text
- https://cdn.sqhk.co/zexupibo/g98t5oS/76471311006.pdfIn PDF document text
- https://cdn.sqhk.co/gijosevozu/ibjjDPk/linen_cabinet_doors.pdfIn PDF document text
- https://cdn.sqhk.co/nimabugokofa/fR4haje/word_crossy_level_6312.pdfIn PDF document text
- https://navikeput.weebly.com/uploads/1/3/4/7/134755574/jegetofalemi.pdfIn PDF document text
- https://cdn.sqhk.co/dajebala/IhiJ8aR/instagram_appeal_block.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d965e5d4-74e3-415b-bc43-0939acf05ed6/24356583631.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c20a606-fc24-44d6-beec-0efb3a939eaf/how_to_cite_the_niv_study_bible_in_apa.pdfIn PDF document text
- https://s3.amazonaws.com/kefefetafij/kuvinedov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16a15016-f3e8-4676-9589-d5e61895fe02/jifajavoworiw.pdfIn PDF document text
- https://s3.amazonaws.com/mukut/13835428603.pdfIn PDF document text
- https://s3.amazonaws.com/lakujusitejojet/whats_a_good_word_for_not_clear.pdfIn PDF document text
- http://puviseb.epizy.com/mupadusutivuzuxoxowal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc9b4aa9-912d-4d27-919f-410650dc7dcb/sketchup_tutorial_download_free.pdfIn PDF document text
- http://kagewopojitij.epizy.com/amelogenesis_imperfecta_articulos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6417f298-f7b4-4ed5-ba2a-0c559e398c52/23486948880.pdfIn PDF document text
- https://s3.amazonaws.com/bulalowisu/96891580912.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d2e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD2E2 | 5072 bytes |
SHA-256: d21ce6eacdd17ade07e4ed5687e41cb7dbcdc4ba1e6453174992b5cce8d25648 |
|||
font_01_sfnt_off0000e40a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE40A | 10996 bytes |
SHA-256: 92a38844d5950a0b139c585da67c7b020dae66f3720972ac3cb0a431792b31c5 |
|||
font_02_sfnt_off000109aa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109AA | 16036 bytes |
SHA-256: 9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.