MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO spam operation. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URL `https://nipisod.ru/strik?utm_term=organizational+behavior+mcshane+4th+edition+pdf+free` is a primary indicator of the lure used.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=organizational+behavior+mcshane+4th+edition+pdf+free PDF link annotation
- https://cdn-cms.f-static.net/uploads/4424011/normal_60523f18ae0d0.pdfIn PDF document text
- https://dakubotamijez.weebly.com/uploads/1/3/2/7/132712147/e2ac7eed.pdfIn PDF document text
- https://butijewib.weebly.com/uploads/1/3/4/8/134886415/nasekuvixolutur.pdfIn PDF document text
- https://fuzifilagowiw.weebly.com/uploads/1/3/4/6/134698760/9599613.pdfIn PDF document text
- https://mafenipo.weebly.com/uploads/1/3/4/8/134879688/wamumileva-dopab-wisuvuji-jekidake.pdfIn PDF document text
- https://pudabesipewoz.weebly.com/uploads/1/3/0/9/130969441/tigodisepegux.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367302/normal_605175a368ea9.pdfIn PDF document text
- https://zorikibezoxima.weebly.com/uploads/1/3/1/3/131384208/c9858ef18e4a29.pdfIn PDF document text
- https://dususujere.weebly.com/uploads/1/3/6/0/136024938/mamekupuf.pdfIn PDF document text
- https://merirano.weebly.com/uploads/1/3/2/7/132710628/8979935.pdfIn PDF document text
- https://fokubazukif.weebly.com/uploads/1/3/2/6/132683137/jefux.pdfIn PDF document text
- https://lukogazusewof.weebly.com/uploads/1/3/4/6/134643336/wivetebodix.pdfIn PDF document text
- https://dimulawi.weebly.com/uploads/1/3/4/3/134380670/320872c8fd41.pdfIn PDF document text
- https://bobazuforabi.weebly.com/uploads/1/3/1/4/131452976/xobikemapo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/ae6e56c4-4743-49ed-af07-c578de47f79e/first_alert_co_detector_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68fa39b0-e9fe-4a31-a5f0-42287701882d/my_name_is_red_google_books.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ae526188-ebb9-46ff-a1dd-3a1dc1fb7e47/mtd_yard_machine_snowblower_spark_plug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d39d4e2-3a3c-47d3-9132-531c1ec5d3f6/75079454443.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ecba7cc-ce99-42f5-96cc-a263146cb85d/disijirema.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7418715a-9ecd-480d-9666-d63ea7a0ec3e/pretty_little_liars_season_4_episode_19_why_is_it_black_and_white.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af47a0a8-180a-4401-940b-515785bbe58b/45835227744.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012427.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12427 | 5932 bytes |
SHA-256: 5ee7801857c7783888cca26fccccea3b76566221bcf0c7234a2ad7145674b6ad |
|||
font_01_sfnt_off0001383c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1383C | 11824 bytes |
SHA-256: 7ed5f578bf7613543d8d36e466d51490b5f76e315856da203872fee21f443508 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.