MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file contains a large number of external links, many hosted on disposable domains, characteristic of a link farm or phishing operation. The ClamAV detection 'Pdf.Phishing.Trojan-d2528dad23a95d95-10044376-0' further supports a malicious intent. The primary URL, https://crewmak.ru/pbw?utm_term=watch+citrus+anime+season+2, suggests a lure related to popular media to entice clicks.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4867
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crewmak.ru/pbw?utm_term=watch+citrus+anime+season+2 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4383678/normal_6068a2ca09c41.pdfIn PDF document text
- https://kogewovedof.weebly.com/uploads/1/3/4/3/134339257/difisovetizakan.pdfIn PDF document text
- https://lirobepofuneve.weebly.com/uploads/1/3/0/7/130740173/9119637.pdfIn PDF document text
- https://kodikitowi.weebly.com/uploads/1/3/4/7/134768405/bb8e3b73ea3f6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4455208/normal_5ffe0a10da7a7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489241/normal_600b68e057a27.pdfIn PDF document text
- https://tebebutak.weebly.com/uploads/1/3/4/7/134744698/rofunop-vodoroganamito.pdfIn PDF document text
- https://buwofapakudo.weebly.com/uploads/1/3/5/3/135316190/mowisumodetule.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495395/normal_6034eb4dd6f79.pdfIn PDF document text
- https://senorori.weebly.com/uploads/1/3/4/6/134641151/4540480.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446026/normal_603af944829d6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4410000/normal_5ff16b54223af.pdfIn PDF document text
- https://ronabamipiboti.weebly.com/uploads/1/3/4/5/134598089/92faa1e3c1435a0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382193/normal_603c6223aad21.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370051/normal_603812c578bf2.pdfIn PDF document text
- https://minikugonon.weebly.com/uploads/1/3/4/5/134500064/xuboruxu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453556/normal_600b009fd9849.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/b7f0bb97-aaf1-44a0-93ac-4f65aa80f521/8640071474.pdfIn PDF document text
- http://kolasotosexu.pbworks.com/w/file/fetch/144412143/vectric_aspire_3.0_keygen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/691e9947-8b2c-415a-9d32-7fb0e5398848/how_to_pressure_cook_chicken_ninja_foodi.pdfIn PDF document text
- http://bukafag.pbworks.com/f/workouts_to_do_at_the_gym_for_weight_loss.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5ea671d-dccd-448c-8495-00e89aec567d/basazuvox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de5c5183-4b73-4ae4-8e28-d32afc3710a9/mafelapuw.pdfIn PDF document text
- http://sisagexal.pbworks.com/f/el_romn_de_flamenca_libro.pdfIn PDF document text
- http://xojipoxar.pbworks.com/w/file/fetch/144447690/80472727559.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac7099bc-9715-48fa-81f7-1a2938685d31/book_summary_rubric_middle_school.pdfIn PDF document text
- http://savavaze.pbworks.com/w/file/fetch/144454518/65784426677.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012a9b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12A9B | 5152 bytes |
SHA-256: 5dff4c8d89ae84237c87aab25b111444836d077d4ee0712213dca9c27cb7b2a3 |
|||
font_01_sfnt_off00013bff.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13BFF | 10704 bytes |
SHA-256: caf36a65a2076fb466d1931a2812f2951c028e7cbc07a30d8afa12de2d507779 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.