MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' indicate a large number of links hosted on disposable domains. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=graphic+design+programs+for+chromebook
- http://felokajeresower.22web.org/physical_and_chemical_properties_of_ammonia.pdf
- https://static.s123-cdn-static.com/uploads/4383698/normal_5fec9de7bc9e8.pdf
- https://cdn-cms.f-static.net/uploads/4459180/normal_6012bbfd781bd.pdf
- https://cdn-cms.f-static.net/uploads/4476924/normal_605aa2c69ab7e.pdf
- https://cdn-cms.f-static.net/uploads/4470837/normal_602ad7004e456.pdf
- https://gitujibexilen.weebly.com/uploads/1/3/1/4/131406430/632220.pdf
- https://gupapuna.weebly.com/uploads/1/3/4/7/134726568/tisiwap.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://86f5e18a-8766-4ae7-b9bf-31430b627380.filesusr.com/ugd/911c12_ce51e87294774e54878d997ab85667c3.pdf?index=true
- https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_508974d2ec1e4493a82af340f79098c8.pdf?index=true
- https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_8ff3926b37d64b1abdb7621fd53593d4.pdf?index=true
- https://59548cc9-d6a6-4b2e-bd73-2bfb7290c7b5.filesusr.com/ugd/3fd21f_acdcf1c3c4f4403ea261cbcaf15a82a5.pdf?index=true
- https://s3.amazonaws.com/tobaziw/scotts_speedy_green_3000_manual.pdf
- https://d0fd22f1-78bd-4368-960d-2a324028b2bb.filesusr.com/ugd/a4d998_3cc942435a5d44d6be51234b31707eb3.pdf?index=true
- https://fc59733d-949e-4df9-817b-fea2515c5cc7.filesusr.com/ugd/689329_adbaea43280344b4a4f58886fde1640e.pdf?index=true
- https://s3.amazonaws.com/juvetaso/vubovifarowidorip.pdf
- https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_fac7c39b580640a5adcea776aebc5bc0.pdf?index=true
- http://diwevobu.rf.gd/marriage_d_amour_sheet_music.pdf
- http://dutakewapil.epizy.com/vipugujiwipejevuwaguj.pdf
- https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_c412f58cf2bf47179bed2e627bde2fb1.pdf?index=true
- https://cb2d4818-2134-4ea5-ae57-1bc45cfc4292.filesusr.com/ugd/7e787c_913d07d8c73140fca41362258ab6e6e4.pdf?index=true
- http://jefefudutumoki.epizy.com/backbeat_go_3_firmware_update.pdf
- https://s3.amazonaws.com/tupofelasujewas/hollister_men_s_size_guide_uk.pdf
- https://9e6c4f0b-3406-4274-bf8a-5be7f948d240.filesusr.com/ugd/45c6ff_653627bb54d041bda83f20a89c0a765e.pdf?index=true
- https://s3.amazonaws.com/fotojipifuzitul/vitamix_stick_blender_review.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012984.binddfa03d16aaa94c793ef8ebcca0f973cd30d9781ec4307e1ced995a37e755872 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12984 | 5480 bytes |
font_01_sfnt_off00013bf0.bin652881550a5b6fab8db0df3456dbcc39ef54b69737e6ec5e3fe099733961097a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13BF0 | 11348 bytes |
font_02_sfnt_off000162d6.bin7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x162D6 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.