MALICIOUS
206
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded URLs, many pointing to disposable hosting services, suggesting a link farm designed to redirect users to malicious sites. The presence of a malformed stream and ClamAV detection as a phishing trojan further indicate malicious intent. The document body, though heavily obfuscated, contains a URL that appears to be a lure for a common search query, likely to trick users into clicking through to a compromised site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTHA PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=how+much+does+a+root+canal+treatment+cost PDF link annotation
- https://cdn-cms.f-static.net/uploads/4470985/normal_60239cd80411f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420776/normal_604132ce8f23c.pdfIn PDF document text
- https://fitarerak.weebly.com/uploads/1/3/5/3/135313257/safuxexajufiruverefi.pdfIn PDF document text
- https://ronabamipiboti.weebly.com/uploads/1/3/4/5/134598089/pusovozofed_fuwij_nifez_woxeboxudegisug.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487662/normal_602e4bfa713be.pdfIn PDF document text
- https://bajarewejewud.weebly.com/uploads/1/3/4/6/134673735/vupesemapikikumir.pdfIn PDF document text
- https://fedubipogumuwu.weebly.com/uploads/1/3/1/3/131379546/juriwebubakibopa.pdfIn PDF document text
- https://falufanimuv.weebly.com/uploads/1/3/4/3/134377488/375921.pdfIn PDF document text
- https://nikokabiliru.weebly.com/uploads/1/3/1/4/131409463/pekoxumi.pdfIn PDF document text
- https://zajefogana.weebly.com/uploads/1/3/1/4/131407312/faxunanowujosel_vajumituri.pdfIn PDF document text
- https://nixitemolepof.weebly.com/uploads/1/3/4/8/134870129/bujunav.pdfIn PDF document text
- https://tazumeter.weebly.com/uploads/1/3/1/4/131438167/06c8cc9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4491945/normal_60074e2a27c9b.pdfIn PDF document text
- https://rozinezo.weebly.com/uploads/1/3/1/6/131636990/wewajana_tajusajo_tisafavinutukin.pdfIn PDF document text
- https://senakubedezozi.weebly.com/uploads/1/3/1/6/131606366/2585711.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d47718eb-5f47-4a26-9545-4a989aa94847/mufakisagomubamixezag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d025380-2f54-4fb2-84aa-ff693b261d64/tres_metros_sobre_el_cielo_3_pelicula_completa_espaol_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b19cf19e-b2f9-4a34-ba14-e20568889a85/dikemivoveduvanib.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/019030de-9920-4f86-85cd-154bbe612a03/31400220524.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c90a4799-a764-4d3f-bd4b-1026483735b4/apocalyptic_super_system_manga_chapter_23.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f5eb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5EB | 5232 bytes |
SHA-256: 036878540edb0cb7ae5421c618a9b2b1e28519359c36853fb3cb13b0dc1bb54f |
|||
font_01_sfnt_off00010795.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10795 | 10500 bytes |
SHA-256: e01c1cbd8a5da8212e2e27138b0fae3e542cf032fe368e80df4d82e0d5a7c26c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.