MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/award?keyword=acog+gestational+diabetes+guidelines+2020+pdf PDF link annotation
- http://lovechat24.club/twilight_saga_breaking_dawn_2_songsk7m5r.pdfIn PDF document text
- http://workbykoder.xyz/can_you_wear_a_long_dress_to_a_cocktail_weddingi3kaq.pdfIn PDF document text
- http://esportzmlevent.com/tamufibarivepaxiqu92r.pdfIn PDF document text
- http://antonio-ita.space/44818472001i7v67.pdfIn PDF document text
- http://kraftmann.su/tiles_hop_color_ball_3d_downloadkif4l.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://9e77dbea-16d6-438e-9859-4a68c5388828.filesusr.com/ugd/3225da_9dbf9bafd9544e1898f756028fce8c03.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wewuxuviwar/wumebokewiguvewudopadexif.pdfIn PDF document text
- https://s3.amazonaws.com/jijumupade/wow_warrior_tank_leveling_guide.pdfIn PDF document text
- https://s3.amazonaws.com/xijalovelokolep/75372556354.pdfIn PDF document text
- https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_9f5efc946ddf49f8bf2ad06543fcd80e.pdf?index=trueIn PDF document text
- https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_05189741f2a44c91bd955ccdf7cee426.pdf?index=trueIn PDF document text
- https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_87b71b9b73ee419399e88c6ef847e87e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/legapatatezisa/kogovareliguzu.pdfIn PDF document text
- https://s3.amazonaws.com/mufukep/cotton_patch_blackened_tilapia_nutritional_information.pdfIn PDF document text
- https://s3.amazonaws.com/gekixadonuru/xenumoxasawanile.pdfIn PDF document text
- https://s3.amazonaws.com/vuxagixil/27992140812.pdfIn PDF document text
- https://9d76d0c6-5807-43ac-a2ba-7b4112d1a20a.filesusr.com/ugd/5cd33b_6139ed0f94fa4d2c8813af9207e5801f.pdf?index=trueIn PDF document text
- https://cda84be5-0c54-4c05-8389-97bb004c798d.filesusr.com/ugd/fa9f00_e780a29d375646068e94c3ce1eeb51a9.pdf?index=trueIn PDF document text
- https://ce322291-b3da-4cc2-ae0f-523e25daec44.filesusr.com/ugd/4530da_875ef732cb1241d2807985e805112a1c.pdf?index=trueIn PDF document text
- https://bc009ca4-5001-4b9f-a166-c8e6b08c1066.filesusr.com/ugd/2d797c_0f11b203735c462597e970979844db77.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fejenijovekozu/english_grammar_tutorial_videos_free_download.pdfIn PDF document text
- https://s3.amazonaws.com/fedure/fivuwolewuzakijogabulej.pdfIn PDF document text
- https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_db76c6c3c7354d38be7432eea793780e.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010fc4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FC4 | 5628 bytes |
SHA-256: e410f14a6fa29fc687efe6f3b7eca6fffc6b69209967471841fbd847daf5b5ee |
|||
font_01_sfnt_off00012300.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12300 | 10840 bytes |
SHA-256: 64d7c7e3fa6ee144ef780ae33180ae71be88eac04c96e35e21125c2494ea24ad |
|||
font_02_sfnt_off0001484b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1484B | 16204 bytes |
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.