MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=business+writing+today+2nd+edition+pdf PDF link annotation
- https://vimijalubatek.weebly.com/uploads/1/3/4/7/134739875/4ca7dfee4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460241/normal_604f7c72368fa.pdfIn PDF document text
- https://dobetabuzaduguz.weebly.com/uploads/1/3/5/3/135312815/fbedb86e7519b03.pdfIn PDF document text
- https://cdn.sqhk.co/fovomesit/ifOqgcc/32905325940.pdfIn PDF document text
- https://cdn.sqhk.co/gotubosif/GielWhi/top_hits_2000_to_2010.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4444378/normal_5febc6ad750a6.pdfIn PDF document text
- https://fefumuvujudadi.weebly.com/uploads/1/3/1/6/131606087/93347165e58755.pdfIn PDF document text
- http://nizavevorupuj.mywebcommunity.org/jizab.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4463005/normal_5fcce6bfc129a.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4459774/normal_5fcb07b940a2c.pdfIn PDF document text
- http://xoziduso.mypressonline.com/tcs_banking_and_financial_services.pdfIn PDF document text
- https://lejujazu.weebly.com/uploads/1/3/5/3/135337057/nuxilomixuzu.pdfIn PDF document text
- https://cdn.sqhk.co/sabepakofo/hheJjft/pigometigetoji.pdfIn PDF document text
- https://begagezegitajaj.weebly.com/uploads/1/3/1/3/131398046/suzetogig-ruzikupagete-lidulafa-dalupe.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d2ef074a-a51a-426f-9765-089bfe185aa7/rijomofunijazamolesaga.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb1cf806-6c96-4da2-80dd-3c48ccdfaba3/ddp_yoga_program_guide.pdfIn PDF document text
- http://gozudil.onlinewebshop.net/mobikudolajixot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd3da453-a049-45d1-8378-48d53f5382e6/letebosukotasa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/17bb1dd3-6d9e-4030-8d53-480e8586b51e/book_of_acts_each_chapter_questions_and_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8deb301f-025b-423e-9d2b-f7e25ff5402d/ge_cafe_gas_range_reviews_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e2ccd848-31e6-414a-a4f6-bcf4903bc829/construction_project_manager_salary_austin_texas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b941a15d-448f-44e0-8527-a4528cb5fdc5/agudas_llanas_esdrujulas_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0970418c-5b2a-4f88-a886-f44a85bbdc4a/how_to_lose_belly_stomach_fat_without_exercise.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0921edb-21a8-4f4e-8943-dc40c9aefd47/navy_fitrep_opening_and_closing_statements.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f4bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF4BF | 5552 bytes |
SHA-256: bd8cf6a36ca98604a1b23c34d127764907ebedd2e30e258f0cd64a4dbb9e7df4 |
|||
font_01_sfnt_off000107d9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107D9 | 10676 bytes |
SHA-256: d3c60e94db99eb7c034cb6a331bf2eae6221e609541ac33e259af9bb761a0fea |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.