MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous external URIs pointing to potentially malicious websites, such as 'https://jumiwimov.ru/strik?utm_term=40+day+love+dare+movie'. The presence of a link farm on disposable hosting suggests an attempt to distribute malware or conduct phishing attacks by redirecting users to compromised or malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=40+day+love+dare+movie PDF link annotation
- http://letnesil.xyz/lights_out_tour_2020_ticketslcde5.pdfIn PDF document text
- http://umdtheatre.ru/safety_first_everfit_car_seat_reviewshvggt.pdfIn PDF document text
- http://kukushpa.fun/do_vibrating_exercise_machine_workewhl9.pdfIn PDF document text
- https://duwesokele.weebly.com/uploads/1/3/1/6/131606866/wibigoz_vodoxejunuwexul.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448121/normal_5fcdce549e0b8.pdfIn PDF document text
- http://dmdmassage.com/19351600317uox5w.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484358/normal_5fd7dea2589d8.pdfIn PDF document text
- http://mxbur.fun/is_nbc_still_on_directvzjn2t.pdfIn PDF document text
- http://help-lnstagram-verifycopyrgiht.com/how_to_make_a_homemade_fractal_antenna_for_hd_and_digital_tv_receptionna16q.pdfIn PDF document text
- http://creditscorerepair.info/7439459933k8mvv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495257/normal_6063a9cf79ddd.pdfIn PDF document text
- https://dovavifedudefew.weebly.com/uploads/1/3/2/7/132710721/7580540.pdfIn PDF document text
- http://ru-payment.casa/boburupajizije7h5du.pdfIn PDF document text
- http://funseeds.site/87636128117p8ek6.pdfIn PDF document text
- http://about-central.com/75313527200lulb7.pdfIn PDF document text
- https://zugufirit.weebly.com/uploads/1/3/1/1/131163535/cd2aeb1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_0bc50ac272d54fd8b62203f1bf8d7722.pdf?index=trueIn PDF document text
- https://0ea28b16-58c2-472d-b6be-3e97fe9b7bb6.filesusr.com/ugd/696b8a_162901e184fb436eaa12c370e2168f08.pdf?index=trueIn PDF document text
- https://b2bd4247-5771-4f9a-9f3f-b46500bff287.filesusr.com/ugd/f41bfe_38d0056c9ee945edb0af2d95069bd2ce.pdf?index=trueIn PDF document text
- https://87b84290-c0b3-4c73-97a1-3d59c64c3f69.filesusr.com/ugd/c638b7_e316b94afe0a4feda436bb219a89004b.pdf?index=trueIn PDF document text
- https://18b62485-dce0-4e35-9712-b1d1f13fcb23.filesusr.com/ugd/296484_29ce0098a3bd484dad099133377a530d.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f252.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF252 | 5092 bytes |
SHA-256: 9b22344846b462bcb65c046dbe844e34ccd36abfef04c04babeb92f961950c3e |
|||
font_01_sfnt_off00010396.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10396 | 1800 bytes |
SHA-256: 51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0 |
|||
font_02_sfnt_off00010c24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C24 | 10536 bytes |
SHA-256: e0547a1ffca0483d4ccfcbd4f60511491e42112164a8e16f3003647c75de6d44 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.