MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristics reveal it functions as a link farm, containing numerous external links, with one pointing to 'https://botokaw.ru/wix?keyword=principal%2527s+office+colorado+springs'. This suggests the document's primary purpose is to redirect users to potentially harmful websites, possibly for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/wix?keyword=principal%2527s+office+colorado+springs
- https://nakabupibuf.weebly.com/uploads/1/3/4/6/134608610/1cacd2de50da771.pdf
- https://kakifimetuwojo.weebly.com/uploads/1/3/4/3/134317364/gevanufu.pdf
- https://vipomumukewa.weebly.com/uploads/1/3/0/8/130813786/buxox.pdf
- https://cdn-cms.f-static.net/uploads/4465252/normal_602d595c93ebb.pdf
- https://xulibaro.weebly.com/uploads/1/3/4/0/134041525/xepufo.pdf
- https://vifozafep.weebly.com/uploads/1/3/1/4/131407061/tikus.pdf
- https://rigugoxa.weebly.com/uploads/1/3/0/7/130776225/f7b03.pdf
- https://rokolumer.weebly.com/uploads/1/3/0/9/130969153/ruketevavi.pdf
- https://cdn.sqhk.co/fetogivaw/7gfL7gd/day_by_day_vacation_planner_template.pdf
- https://jikumudepopojet.weebly.com/uploads/1/3/1/4/131453433/ba384a.pdf
- https://cdn-cms.f-static.net/uploads/4480743/normal_60276798b1768.pdf
- https://cdn-cms.f-static.net/uploads/4393019/normal_60486586593bf.pdf
- https://cdn.sqhk.co/padasagam/hjZdhaz/icao_annex_6_2016.pdf
- https://static.s123-cdn-static.com/uploads/4423728/normal_5ffd73f096549.pdf
- https://cdn.sqhk.co/kupejabel/hcFibhe/stylish_fonts_for_pc_free_download.pdf
- https://radolawijukigi.weebly.com/uploads/1/3/5/9/135992833/mabizelefilizororu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/78dd0d3a-6f39-4593-aded-d098ba51c433/what_are_the_specials_at_arbys.pdf
- https://s3.amazonaws.com/dusined/girofewa.pdf
- https://s3.amazonaws.com/rewepalazamiso/comprehensive_medical_report_example.pdf
- https://uploads.strikinglycdn.com/files/a91d489f-c26c-434a-97e2-92949cee499d/motorola_talkabout_manual_t200.pdf
- https://uploads.strikinglycdn.com/files/4d7da8d9-89ac-41ea-96c3-2bdd55a61a19/coldest_town_in_the_usa.pdf
- https://s3.amazonaws.com/kizugokofo/educational_worksheets_for_4_year_olds.pdf
- https://uploads.strikinglycdn.com/files/26101667-c570-423f-8bec-72ed6a9df08b/which_best_compares_the_themes_of_oedipus_rex.pdf
- https://uploads.strikinglycdn.com/files/a5d802ad-9a3d-4014-a633-ee694f5c85c6/kenmore_elite_dryer_heating_element_cost.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4dc.binf786ee680d93a9c87a5e799504e3edb363c9eaf32eb6de661a4a72b8e30e2125 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4DC | 5360 bytes |
font_01_sfnt_off0000f72b.bin82dad7700a2b823dc8cc155488348cd8478fc3bbd3a4ee1baff3247ccfe10f3d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF72B | 10812 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.