MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/123?utm_term=cardi+b+song+press+video PDF link annotation
- http://neyroskakalka.site/the_day_after_roswell_wikixga84.pdfIn PDF document text
- https://wisolowiguwo.weebly.com/uploads/1/3/4/6/134630140/kuximurixu.pdfIn PDF document text
- https://ralanuda.weebly.com/uploads/1/3/0/7/130775203/27661e0b.pdfIn PDF document text
- https://xopadubimedo.weebly.com/uploads/1/3/4/8/134858850/1986237.pdfIn PDF document text
- https://depesusexufajev.weebly.com/uploads/1/3/5/3/135351117/koraziguzosixak.pdfIn PDF document text
- http://presentinsta.online/tutuzolidablsrb.pdfIn PDF document text
- https://welusagosa.weebly.com/uploads/1/3/4/3/134355806/zisupa.pdfIn PDF document text
- https://tuxutumixebapi.weebly.com/uploads/1/3/1/4/131438514/voremizagujav.pdfIn PDF document text
- https://morisefomu.weebly.com/uploads/1/3/0/9/130969566/81242.pdfIn PDF document text
- http://pametuf.22web.org/oxigenoterapia_hiperbrica_scielo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_0708892b2aa44429b0ad2f7b9f8051bd.pdf?index=trueIn PDF document text
- https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_47b602ab665d44a59538a97fe5418e63.pdf?index=trueIn PDF document text
- https://977c49e7-b386-4807-8e45-538ee7e999a1.filesusr.com/ugd/c345b0_487e8d5ae8e5421c90d2d88d2820cd6f.pdf?index=trueIn PDF document text
- https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_1a8979434ff742eea0dd8c2480e715bd.pdf?index=trueIn PDF document text
- http://julisumuxolo.rf.gd/witemijolosunesejoxasutu.pdfIn PDF document text
- https://80ce5912-1c67-4773-adf4-abf614566e91.filesusr.com/ugd/acb48a_8898d324cbd54613b8554503830afb5f.pdf?index=trueIn PDF document text
- http://momugegunimex.rf.gd/tawemanetawowo.pdfIn PDF document text
- https://5d9de69b-f80b-44d6-9c2d-9027806fef0b.filesusr.com/ugd/e26ad2_589e31115ee949f191a8146ca5c6fd83.pdf?index=trueIn PDF document text
- https://6cbe2f5c-748b-4bc6-b691-25a968a47885.filesusr.com/ugd/d6b5da_583f4949386d49d7b4642ea0a4fe219b.pdf?index=trueIn PDF document text
- https://da6a6a96-7907-4aac-bfe3-592928b14ca9.filesusr.com/ugd/39e844_c5a4846cda49463aa9bb137fcb90a105.pdf?index=trueIn PDF document text
- http://kevatudoritek.rf.gd/michelin_guide_france_2019_english_edition.pdfIn PDF document text
- https://78f5967e-1348-44d0-b43d-4fba71d4c3e7.filesusr.com/ugd/a94f6a_7eedceb2ea7144179427c9982b3b0e17.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edc5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDC5 | 5200 bytes |
SHA-256: 08ecf2883146c24ada56a652f5bcfc2706718cc3fa981c253bdf639e685277ff |
|||
font_01_sfnt_off0000ff79.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF79 | 11560 bytes |
SHA-256: e22d5f917110639a4a0d07272496270e03b1cef18d53c13b2f81fe15f3bb4ec8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.