MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=new+york+times+college+point+jobs PDF link annotation
- https://cdn-cms.f-static.net/uploads/4491153/normal_6040775fc67c7.pdfIn PDF document text
- http://natosabi.mygamesonline.org/autonomous_maintenance.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449779/normal_606e040379cd2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4390071/normal_602e0ebfcbeae.pdfIn PDF document text
- http://tetupamino.mywebcommunity.org/lose_weight_eating_apples_only.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462726/normal_6044692152d59.pdfIn PDF document text
- http://jaralet.getenjoyment.net/75654318495.pdfIn PDF document text
- http://wativeb.mypressonline.com/zugivuwirorabo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421641/normal_602418b074b2a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://3a00e800-a8eb-44ae-aafc-ae9aecab8e06.filesusr.com/ugd/1715bf_995e30c719524bb4a21fe9bb2668dcb9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8adbb53f-ec4b-4831-bacb-e94746f83b72/best_invisible_selfie_stick_for_gopro_max.pdfIn PDF document text
- https://5c839259-519f-4cee-a1a2-6639d654070b.filesusr.com/ugd/140efa_0cddda7e845f44feba21611afff4dca3.pdf?index=trueIn PDF document text
- https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_996d094c708943f5916e895d550b3ce2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b391cbcd-02d3-40ae-aa59-d4edd60c488f/32781247045.pdfIn PDF document text
- https://e082b6be-64c0-45f6-a8ff-82b9c6f476f0.filesusr.com/ugd/1479de_842326dcbbcf4e7080ebba9ccc9a58eb.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a6c2ab79-c2e2-465f-937e-a3a4b628404a/44211867288.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d520886f-a0f4-4192-ac19-43696bf25980/hp_designjet_500_software_windows_10.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a39f3529-5a0d-487e-9737-88332929123e/ilive_sound_bar_wont_turn_on.pdfIn PDF document text
- https://bed2724e-b6a4-42c6-a365-5b2dc6a82e2f.filesusr.com/ugd/9f087b_a79049a6072a49a68d69476a300d8736.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c8f438c1-631c-4574-bda2-543dd5173b1c/kenmore_stacked_washer_dryer_model_417.pdfIn PDF document text
- https://b3709dad-42f4-4621-9b7e-74d31ca978cd.filesusr.com/ugd/f91cf1_bfedf2d14a8f49018af0812fee5ffce7.pdf?index=trueIn PDF document text
- https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_05857c36dab544fda1c8a857ac28b191.pdf?index=trueIn PDF document text
- https://0404cab7-c021-4537-be79-420bcb2f88cc.filesusr.com/ugd/52c240_a213771f77714798a1d930ca1a456432.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4c39aa54-d797-4ef1-94d5-5ab6ebc4edfb/asus_dsl-ac68u_review.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f531.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF531 | 5488 bytes |
SHA-256: 7cea91fd6a00488f5517179efd2a3564b42e75766aec1ec9c99ea71a95850191 |
|||
font_01_sfnt_off000107ed.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107ED | 10172 bytes |
SHA-256: ef34b31c90778fc59c744b6a1d067ffdd468ad51ea0a89583153a6c66954f73d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.