MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable domains, suggesting a link farm designed to redirect users to potentially harmful content. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic further support this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=writing+activities+for+kindergarten+students PDF link annotation
- https://vataripisak.weebly.com/uploads/1/3/4/6/134600115/23882b09dfdc38.pdfIn PDF document text
- https://xupazipul.weebly.com/uploads/1/3/5/3/135325103/3504536.pdfIn PDF document text
- https://desebenenoda.weebly.com/uploads/1/3/5/3/135348916/1592210.pdfIn PDF document text
- https://limumowitizuwag.weebly.com/uploads/1/3/4/5/134587832/9e0b31ca47c.pdfIn PDF document text
- https://malinozibide.weebly.com/uploads/1/3/4/3/134380659/lirivaralas.pdfIn PDF document text
- https://digafixi.weebly.com/uploads/1/3/0/7/130776371/fubapediradiwujikove.pdfIn PDF document text
- https://livekurot.weebly.com/uploads/1/3/4/4/134443702/vidoza.pdfIn PDF document text
- https://mefiwoteta.weebly.com/uploads/1/3/5/9/135956645/439980.pdfIn PDF document text
- https://ganafotereko.weebly.com/uploads/1/3/1/1/131164127/5340998.pdfIn PDF document text
- https://rapozudomemixu.weebly.com/uploads/1/3/5/3/135330029/c4573b888eee7b2.pdfIn PDF document text
- https://katifakemu.weebly.com/uploads/1/3/1/3/131381151/4f9a2e69841.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/e63c588a-d533-4fb8-b3ff-00e03c26b803/79628313712.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd55b852-3e41-473a-a167-3275c4cb93c0/43189539646.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/60016091-8fdc-406f-8956-1a8b391412ff/nudebuliwufoso.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/48ce74f5-6889-4cae-850e-b5eb569c4003/tiwuvibegabenavu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b0031c3-19be-4826-ab07-9a2f99293156/bowugiragevubexijijabegu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f526daf2-a346-4109-af9c-e01c36514898/wemagesukufirefajomurag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d768ebd1-5628-4cc3-80b5-51ba38abe48f/womabobafisamafarageb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0de09df5-2396-4858-ba93-4a8c26dec6f7/what_is_project_x_based_on.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5fa1f967-fc25-44ba-9919-730853cc5f92/what_food_is_suitable_for_gastritis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb4a4b3a-b17b-4910-a309-60100cf729ab/90882992655.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fedf7da2-7f63-42af-81d2-932121ca680b/what_happens_in_art_of_living_course.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010810.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10810 | 5292 bytes |
SHA-256: 23f1557b10a9c11e3512a67c60a81dfca848942a97e60e5a08d81311af4b9241 |
|||
font_01_sfnt_off00011a3b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A3B | 10552 bytes |
SHA-256: 03fe9229bce04b359c0b98c2b6d590ca2a3960fb1175ffb48d1f4543d7ca4142 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.