MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=brother+hl+2270dw+driver+mac PDF link annotation
- http://gimanobidetage.iblogger.org/consumer_buying_behaviour_towards_online_shopping.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369179/normal_6009f5d26bd11.pdfIn PDF document text
- https://cdn.sqhk.co/guvevifowo/jfRFcge/35320499203.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4416125/normal_5fdec90cea512.pdfIn PDF document text
- http://vatamulejuvovi.22web.org/4757587176.pdfIn PDF document text
- https://cdn.sqhk.co/zanudiwageg/DificF7/sinif.pdfIn PDF document text
- https://cdn.sqhk.co/sofawaju/3Bicsii/luzir.pdfIn PDF document text
- https://cdn.sqhk.co/gijimexuv/cIKhda3/color_card_game_play_for_fun.pdfIn PDF document text
- http://wotubodedokejag.iblogger.org/vapexafamawaluxadum.pdfIn PDF document text
- https://cdn.sqhk.co/nosisatoved/ijaEbgg/the_banner_saga_trilogy.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bewibiwat/2016_lexus_gs_350_interior_dimensions.pdfIn PDF document text
- https://84d655c4-d84a-4a0c-9c32-0387925bd622.filesusr.com/ugd/6233da_8da2c995e4c24449bb21d8ea298f2cd2.pdf?index=trueIn PDF document text
- https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_e87efe6f0f2a4b12a1e3b198a12c7f58.pdf?index=trueIn PDF document text
- https://41d9b059-0b17-466b-96e6-f31a3f3e9b19.filesusr.com/ugd/f1ead9_62c9213778cc4b559be52536b04dbc8f.pdf?index=trueIn PDF document text
- http://dejugatifug.rf.gd/71629956741.pdfIn PDF document text
- https://451b78f8-089e-4d4d-bc4b-60abb621f7e6.filesusr.com/ugd/7ef0dc_194a00ed25584853982b08e9cebc485f.pdf?index=trueIn PDF document text
- https://9a89a7da-ede3-42eb-a537-7416be21eb2d.filesusr.com/ugd/aaaf79_0ce5c7c28fc64761afdb5fd22af71f38.pdf?index=trueIn PDF document text
- https://f8e303d0-f350-43d2-b7c3-f886ef13ec25.filesusr.com/ugd/1bb397_d6588fb5c0314d78bcbbfc862fea5101.pdf?index=trueIn PDF document text
- https://bff5fdab-9fd0-4670-908b-a1308bb5a9cb.filesusr.com/ugd/227d0f_c7753aa7b13349b2be3169d21cd25738.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vebenok/modelo_de_memorandum_de_llamada_de_atencion_por_incumplimiento.pdfIn PDF document text
- https://ccd4a2e6-63e2-4dcb-a02e-1ae1253dabcc.filesusr.com/ugd/059ff1_f387c58b0b014a40a410352da39d4005.pdf?index=trueIn PDF document text
- https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_e747110b59fd4e17bc373c84633feb26.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2DE | 5556 bytes |
SHA-256: 3675ebe264ec864341519b702f72dc85a9a97e74fc8fae72d3894a04e5c67285 |
|||
font_01_sfnt_off000105b4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105B4 | 10920 bytes |
SHA-256: 8ba984b77189db8f06555ee06d2b2cba38197ea7e767a8340d3beab3f9eb601e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.