MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=palma+de+cera+restaurant PDF link annotation
- https://cdn.sqhk.co/xugiwatokax/ejfV9mw/coloring_worksheets_for_year_1.pdfIn PDF document text
- https://cdn.sqhk.co/torazanopuni/3gg5bOJ/28730127520.pdfIn PDF document text
- http://lidlid.xyz/gekovojexijobajafapmjrmv.pdfIn PDF document text
- https://cdn.sqhk.co/juvanejejuwo/a0NXSi0/92402386483.pdfIn PDF document text
- https://cdn.sqhk.co/begokaxawip/Xz6hbgg/parents_guide_doom_eternal.pdfIn PDF document text
- https://cdn.sqhk.co/bebumula/ihfGqVb/diamond_mines_in_africa_map.pdfIn PDF document text
- http://garderob-podolsk.ru/wahls_protocol_mealsl5724.pdfIn PDF document text
- https://cdn.sqhk.co/furaxofir/dihcreH/buzopoxozet.pdfIn PDF document text
- https://cdn.sqhk.co/gigijuke/In7chcE/promotional_discount_codes_for_amazon.pdfIn PDF document text
- https://cdn.sqhk.co/duditizonut/GghBjct/stokke_tripp_trapp_tray_removal.pdfIn PDF document text
- http://springtea.space/bujefabivudunomeb8sfpf.pdfIn PDF document text
- https://cdn.sqhk.co/fodumisux/aicAjiD/ziranisu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fe1f4aab-f682-416c-930f-de7ab41ff7c0/washington_dc_map_metro_overlay.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4a5b6cb-8326-42e7-9065-16d3dc5bf3cf/godin_a6_ultra_koa_hg_limited_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4fbb8cbc-0e81-4c31-ab1f-ba65ba8b56c2/abc_cursive_writing_font_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9675489d-0a23-4d2a-b59d-942540645c5c/jarunujoke.pdfIn PDF document text
- https://de2a8dfc-dc8d-4d62-be3b-f97abdd17bf6.filesusr.com/ugd/c722c2_6c0625c3f646467c986ffb7f42fe928d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0806eab9-3c0f-4eb3-9b5d-f827eeb9acfd/40318154295.pdfIn PDF document text
- https://17500468-634e-4f48-81ad-48a4a068d6fa.filesusr.com/ugd/dcac76_9e72d03b648442c2a5e088c657bf3177.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/32f36459-1a6a-4fc6-b581-b79574abb5e7/smoothies_to_lose_belly_fat_fast.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4b9f0604-72d2-4ef4-b3e1-074775ce14c4/norujofivilusox.pdfIn PDF document text
- https://48b7024d-7414-4593-b44d-ed892b96ad15.filesusr.com/ugd/3e5db3_d6fbea84981d4fbb99e0fd55836012e7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cc09a056-7a63-49ca-9b96-7b3d6f6d084b/dsc_neo_add_user_code.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cfde.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCFDE | 5084 bytes |
SHA-256: e87e33ed4c2d74feebb984fa8803877abbd2f3efde9f62f0cb49fbe0e513013e |
|||
font_01_sfnt_off0000e110.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE110 | 11012 bytes |
SHA-256: 2f06936bcba57b029816eaa2443ffad8949a0219dcc606cb5356772972ce6c8f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.