MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to other PDF files, suggesting a link farm or redirection mechanism. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware delivery. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic point towards an attempt to distribute or redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/wix?keyword=midgard+heroes+handbook+review
- https://static.s123-cdn-static.com/uploads/4478398/normal_5fefcbf0a44d5.pdf
- https://zizolewezefid.weebly.com/uploads/1/3/4/7/134702939/7332203.pdf
- http://dresdenpharma.ru/where_can_i_find_the_disney_princess_filterv0l11.pdf
- https://govonomuvilikiw.weebly.com/uploads/1/3/4/6/134620083/rasabis.pdf
- https://figidurilope.weebly.com/uploads/1/3/1/4/131452961/zubitavuvinif.pdf
- https://sejumajofejopib.weebly.com/uploads/1/3/2/7/132740214/3851183.pdf
- https://cdn-cms.f-static.net/uploads/4478137/normal_601a3a0660358.pdf
- https://cdn-cms.f-static.net/uploads/4504568/normal_6026f68e9e778.pdf
- https://pitalozel.weebly.com/uploads/1/3/1/3/131384414/zowipon.pdf
- https://duwizule.weebly.com/uploads/1/3/4/6/134663296/6577ba36c.pdf
- http://marinarus.space/131577457747x383.pdf
- https://cdn-cms.f-static.net/uploads/4454990/normal_60146c8b530b5.pdf
- http://marafonsport.site/human_geography_translation_in_tamil0jqw1.pdf
- https://zajinepimasi.weebly.com/uploads/1/3/2/8/132815118/3905772.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/6ed569d7-3f27-40ad-a34f-24f5dea6509a/zivusog.pdf
- https://uploads.strikinglycdn.com/files/de50c2d0-0d26-49e6-8455-a0b15e10c205/does_all_almond_milk_contain_carrageenan.pdf
- https://uploads.strikinglycdn.com/files/0f7cbc73-37c7-45df-bbc7-c120f8cef21e/wemuveririvamufeminufe.pdf
- https://uploads.strikinglycdn.com/files/8f595c72-4a56-493f-9f98-6206657a8eba/irony_examples_in_letter_from_birmingham_jail.pdf
- https://uploads.strikinglycdn.com/files/f891f409-fc86-4bf5-86bf-acd213ed4975/how_to_download_the_sixth_and_seventh_book_of_moses.pdf
- https://uploads.strikinglycdn.com/files/903b29bf-c6f2-44fa-8fa8-8d5783a70361/what_is_180_degree_viewing_angle.pdf
- https://uploads.strikinglycdn.com/files/69227013-3e3a-4920-8405-d9e1b7eb4e99/hp_consumer_desktop_pc_bios_update_rom_family_ssid_82f2.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb62.bina622749aa67a1caa4e422c5a098c0470877bc3bab22eeab905e967ff6cbfb012 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB62 | 5416 bytes |
font_01_sfnt_off00010de5.binc8834099e26026f4e3069cea88fc2e1c055b0368257a557d6e2b78d49ff14b0c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DE5 | 10804 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.