MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many hosted on disposable domains, indicating a link farm or phishing lure. The ClamAV detection and ML classifier strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and numerous external URLs point towards a malicious document, likely used for initial access via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ketchas.ru/pbw?utm_term=mirami+chat+alternative
- https://durabikat.weebly.com/uploads/1/3/4/5/134512276/tesijevadi-nigopiguruw-zavububowew-xozipolexa.pdf
- https://lizodeva.weebly.com/uploads/1/3/5/3/135342900/208024c5c69e4.pdf
- https://cdn-cms.f-static.net/uploads/4421780/normal_602554c5bcb1b.pdf
- https://cdn-cms.f-static.net/uploads/4419001/normal_6010abbaccbb8.pdf
- https://static.s123-cdn-static.com/uploads/4410717/normal_5fe0fbb3cce64.pdf
- https://lawoxotat.weebly.com/uploads/1/3/4/5/134587222/xinenetu.pdf
- https://toguvanamevodo.weebly.com/uploads/1/3/4/6/134615804/182ab7d76a9dd68.pdf
- https://cdn-cms.f-static.net/uploads/4369503/normal_6018384fb4732.pdf
- https://cdn-cms.f-static.net/uploads/4366010/normal_6068984b3b7ce.pdf
- https://nagofojog.weebly.com/uploads/1/3/4/5/134586362/9034150.pdf
- https://tufelonidozuwux.weebly.com/uploads/1/3/2/6/132681512/b4ac6238a657f.pdf
- https://gowiwoniba.weebly.com/uploads/1/3/1/8/131857243/fiwumakurepu-marow.pdf
- https://benaputilog.weebly.com/uploads/1/3/4/7/134707665/maxutaselefuve.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f467f122-97ec-4e25-aed9-829cf053dcc8/15477968515.pdf
- http://gazumadu.pbworks.com/f/exponents_class_7_icse_worksheets.pdf
- http://tisowowuduwe.pbworks.com/w/file/fetch/144426921/gta_vice_city_save_game_after_demolition_man.pdf
- http://pobonagul.pbworks.com/w/file/fetch/144463443/17199514333.pdf
- https://uploads.strikinglycdn.com/files/572a5440-58f8-4801-9ec3-0dd5309f2d0a/lejelavifavit.pdf
- http://vodopaw.pbworks.com/w/file/fetch/144879153/apharan_download_free.pdf
- https://uploads.strikinglycdn.com/files/c39f00a2-4ba6-4eef-b011-81fcafbfd19f/safeway_club_card_employee_discount.pdf
- http://febevolojezu.pbworks.com/f/aot_tribute_game.pdf
- http://wejojixi.pbworks.com/w/file/fetch/144999765/zupatepaxozu.pdf
- http://lekadebixe.pbworks.com/f/research_methodology_final_exam_questions_and_answers.pdf
- https://uploads.strikinglycdn.com/files/bac7a2fc-6343-46af-a4b6-044643fe3c3f/31368618090.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_004_off00011c51.binb3b649313c00c2f823ea86bb58d8ffb731301d1675826ff157946fc2d2073c8b |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11C51 | 17328 bytes |
font_00_sfnt_off0000df20.binb2e4099758b38396f2479d8dabe2ad5a72bcddaaea65f81795292503cb7928bc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDF20 | 4924 bytes |
font_01_sfnt_off0000efc4.bin7e2a20640408128c21651ba2350530613228a907f3af1035ff63f56af41f5032 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFC4 | 13984 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.