MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to other PDFs, suggesting a link farm or SEO poisoning tactic. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as phishing or a trojan. While no scripts were directly extracted, the PDF structure and heuristic firings point towards a malicious document designed to distribute further content or lead users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9960
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kabuxezalexafa.weebly.com/uploads/1/3/0/8/130814122/4539221.pdf
- https://nigovazimosa.weebly.com/uploads/1/3/4/6/134636686/muwapoti_walubemop.pdf
- https://jusodudefepad.weebly.com/uploads/1/3/4/6/134650432/xuxopumavuloxa_lazuxad_figogu_lixisiw.pdf
- https://denelabi.weebly.com/uploads/1/3/4/1/134109088/2764609.pdf
- https://xogoluxoso.weebly.com/uploads/1/3/4/4/134444279/zinotigesifovajik.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://feedproxy.google.com/~r/wb/ENAH/~3/kMuynZNWtA0/wb?keyword=where%20to%20put%20power%20steering%20fluid%20in%202010%20ford%20fusion
- https://uploads.strikinglycdn.com/files/7bbdb74b-6c93-4559-aae1-35b7952329bc/tulosajevinidevibojipala.pdf
- https://uploads.strikinglycdn.com/files/0b72c3e1-a44d-42ff-a108-720e19178df4/1003247038.pdf
- https://uploads.strikinglycdn.com/files/c4c333d2-0b42-41b0-8547-4729ec60146c/before_you_say_i_do_book_nuri_muhammad.pdf
- https://uploads.strikinglycdn.com/files/a959759c-d50d-4d4d-83b3-53be05ec6609/most_commonly_used_phrasal_verbs_in_english.pdf
- https://s3.amazonaws.com/satudifin/1824496689.pdf
- https://uploads.strikinglycdn.com/files/d39d436e-be5d-4621-9345-5275934be3ca/98454737147.pdf
- https://uploads.strikinglycdn.com/files/9e5f9e19-dca1-49bc-8f75-1b7bb9aba190/survival_courses_near_me.pdf
- https://s3.amazonaws.com/mexesazaxasa/wuzaposajotakugivafosa.pdf
- https://uploads.strikinglycdn.com/files/7e67f18c-ef8f-485d-b69e-98c11483bcf9/suvogekawum.pdf
- https://uploads.strikinglycdn.com/files/99b3c646-4c2a-4608-a6c4-de62f793f7ee/kevopolelifapusewufo.pdf
- https://uploads.strikinglycdn.com/files/d6b92d36-6b92-45ca-bc30-b8da2d42b665/nutrition_for_life_book.pdf
- https://uploads.strikinglycdn.com/files/01698c67-4aa7-4ee8-864d-f390001ae153/craftsman_3x21_belt_sander_parts.pdf
- https://s3.amazonaws.com/dusined/html_bootstrap_form_creator.pdf
- https://uploads.strikinglycdn.com/files/4a254ecc-0afe-427f-90c4-c575043b9a7f/strength_to_love_download.pdf
- https://uploads.strikinglycdn.com/files/0f9ac298-7722-4d5a-8cd9-63af70ad0f87/samijavojulimigilabif.pdf
- https://uploads.strikinglycdn.com/files/26177f64-6399-4176-a1c5-49ac0f6621e4/volezijawurilajaka.pdf
- https://uploads.strikinglycdn.com/files/68b789e1-79ed-4a97-beda-de5719f7e6d8/86727591155.pdf
- https://uploads.strikinglycdn.com/files/0adc47ed-b22b-42f2-b2d7-078c6cdc5c13/15331203630.pdf
- https://s3.amazonaws.com/zuguvoxoki/selij.pdf
- https://uploads.strikinglycdn.com/files/a96618d9-0de5-40e1-89f1-d2dc2c9b6171/dell_poweredge_2950_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/93ed933e-96aa-43ef-9100-81276d21dcae/joseph_campbell_foundation.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e610.bin3ad656a39f11e07394b51d5e7f018912928f28a480b2004e89d168890b16b84c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE610 | 5524 bytes |
font_01_sfnt_off0000f900.bin4efd5b2bacbc595b06f95493c4d1d9c2bbdc265150ede0f74af785acbc75f309 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF900 | 10652 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.