MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
T1203 Exploitation for Client Execution
This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many of which are generated for SEO purposes, pointing to a suspicious domain 'catamma.ru'. The document body is heavily obfuscated, but the presence of external links suggests an attempt to redirect users to malicious content or phishing sites. The PDF_SEO_LINK_FARM heuristic further supports this, indicating a deliberate attempt to create a link farm.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/pbw?utm_term=disney+plus+hotstar+app+download+apkpure PDF link annotation
- https://vokevifiv.weebly.com/uploads/1/3/4/6/134657891/e7465b.pdfIn PDF document text
- https://wokulenazaxur.weebly.com/uploads/1/3/4/7/134744474/03c4a83.pdfIn PDF document text
- https://kozegefiseram.weebly.com/uploads/1/3/1/3/131379202/kesajelij_gugudorareteke.pdfIn PDF document text
- https://febavezexiwajo.weebly.com/uploads/1/3/4/7/134703432/8451683.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/182562c7-78d6-47c5-90dd-16bc061238ea/baby_trend_jogger_stroller_parts.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1fc6a3ba-daf2-450c-81a3-ff26297293de/2018_kawasaki_kx250f_owners_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ae7a250d-351d-4acd-ae86-3fa9f1ee9dae/tidiruvo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/afcac347-eae8-4aa2-9feb-ea76ad9facae/75633449326.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/26a7020d-c7c5-472f-b853-9f7b249da11c/98283972805.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97ca80d1-5d77-49ec-bf85-8bbdc7416aba/lesson_before_dying_quotes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d9d8032-a74e-4723-a6d8-b6f821801f46/79052966608.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cacc41bd-3c45-4031-b2f8-355dc1986240/is_arma_3_fun_single_player.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e12c4297-4a4c-4f14-b0c3-7a7f375071eb/719589083.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b47a38ae-393c-447f-aeff-9be890f7d9eb/kimefomapixuxesoji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e1cd6d3-3f0d-494e-94de-5821dabe9d5a/state_employees_credit_union_north_carolina_chapel_hill.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5ed6586-60a3-4052-a9f9-dc344442b7a0/1000_free_games_to_play_slots_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5dcb4fd-dbc1-40da-b43e-fd9480fa9a61/super_mario_64_strategy_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ef39a42f-cd7b-4d92-ad00-8a8dcb352f5e/witcher_3_strategy_guide_walmart.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6c3aad8-d5c3-4181-8973-c7b9e912287c/kingsman_the_secret_service_movie_free_download_in_tamil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e44fd3dd-139c-416b-9ac6-0d5f9a08f67d/44527724751.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dc7a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDC7A | 5304 bytes |
SHA-256: 031d755ab1b8f4e6fb0afda6ab8bfe2f6f0742c5e33a678330fc5b1f80a08147 |
|||
font_01_sfnt_off0000ee98.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE98 | 10608 bytes |
SHA-256: 9a94dc432b9cd501821e404abcdd50c78af540990d4e2999daa8c4f75e544b6e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.