MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm used for phishing or malware distribution. The embedded URLs, such as 'https://lozipotod.ru/strik?utm_term=salary+data+science+manager', are likely part of this malicious infrastructure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9964
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=salary+data+science+manager
- https://cdn.sqhk.co/mejofiwog/gvFieCr/93846092252.pdf
- http://tadosuzewamu.medianewsonline.com/tocqueville_the_old_regime_and_the_french_revolution.pdf
- https://posokirotol.weebly.com/uploads/1/3/2/8/132814476/53d6775f.pdf
- http://sandiego-podcasts.com/american_assassin_trailer_reaction4pc1b.pdf
- https://cdn.sqhk.co/kitaparek/j8ig9hf/rifezofewanagasaj.pdf
- https://jawokisejul.weebly.com/uploads/1/3/4/6/134601468/mopodiligufujofop.pdf
- https://kipowiginudi.weebly.com/uploads/1/3/1/3/131383469/7609698.pdf
- https://dowixedazu.weebly.com/uploads/1/3/1/4/131409709/borunakim.pdf
- http://dirtygirl.fun/23618650148jvr1o.pdf
- http://tramlaweq.online/99342035237ywg7t.pdf
- https://cdn.sqhk.co/givifevulo/ijgghXw/64719537133.pdf
- http://wejaduz.mypressonline.com/biology_notes_for_class_12_cbse_download.pdf
- http://kujunat.medianewsonline.com/environmental_awareness_book.pdf
- https://cdn.sqhk.co/piwewupovo/hagdy5Z/46536858312.pdf
- http://youla-24.cc/how_to_start_a_craftsman_lt1000_riding_lawn_mowerax2jr.pdf
- https://zivumabozado.weebly.com/uploads/1/3/4/8/134858695/60626.pdf
- http://gogogoinst.xyz/coleman_spa_model_471_manualpem9p.pdf
- https://cdn.sqhk.co/zepipawetopi/b6I4aia/pico_rivera_car_wash.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_bfa89da868c64a889a6ee472f00f723d.pdf?index=true
- https://s3.amazonaws.com/libusamagowuvo/which_online_business_is_most_profitable.pdf
- https://6648aa49-deb3-4d6f-81a8-a63cc7a297fb.filesusr.com/ugd/38eac1_1d28d87340814646a1a669e152d22769.pdf?index=true
- https://a3720f92-bdaa-4449-a3ff-14f36884d2d5.filesusr.com/ugd/afadc3_02660d71b0564f1b9c1570d4e19a51f8.pdf?index=true
- https://s3.amazonaws.com/fadupazageraf/foscam_fi9900p_factory_reset.pdf
- https://s3.amazonaws.com/wixanarer/42299774730.pdf
- https://s3.amazonaws.com/roware/tulufixaxoja.pdf
- https://s3.amazonaws.com/zazelujeju/the_family_man_full_movie_khatrimaza.pdf
- https://901c4554-6fda-40bf-8344-1f1538f5dc06.filesusr.com/ugd/a76634_a1efa2efaf71435faec5b6fd8a4b6fc2.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010bf3.bin7c4becb54f01b09b4ed457c276540c6fc86916357b65a61dae30e9b32240c4c8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BF3 | 5464 bytes |
font_01_sfnt_off00011e78.bin5e4cc08f60a4f83ce3e055b5d70731b7bc8f894577c37637519de9d10a5bba96 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E78 | 11516 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.