MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9904
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/123?utm_term=iron+man+games+free++for+mobile PDF link annotation
- https://static.s123-cdn-static.com/uploads/4477401/normal_5ffc7ced83eed.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385010/normal_601f014c474a7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4390055/normal_603036d0610b8.pdfIn PDF document text
- https://wininivawad.weebly.com/uploads/1/3/1/4/131483201/442209.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455208/normal_6038887b88f97.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449992/normal_5fe580fc6769a.pdfIn PDF document text
- https://dolilifiwu.weebly.com/uploads/1/3/4/4/134401054/togagotisagerikiv.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485589/normal_605ca18163e5c.pdfIn PDF document text
- https://mixutexevegov.weebly.com/uploads/1/3/4/7/134706804/bodopeboxavoxotekaxo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495551/normal_605fdf5b21ac8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427529/normal_606b30137b907.pdfIn PDF document text
- https://kugekubaf.weebly.com/uploads/1/3/7/5/137511437/5147352.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445321/normal_601ad20914039.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368788/normal_6051c96029161.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4376870/normal_5fcdb25a5e603.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484636/normal_606992decaec3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7bef475f-850c-4262-8eb0-b7035cbb09f8/how_do_i_transfer_my_mobile_tickets_on_stubhub.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5cef0b74-b957-4409-959b-8af86b310969/how_to_report_someone_on_discord_for_dm_advertising.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/297de1d0-3b31-4b4b-ab18-3e1277fae910/zig_ziglar_self_talk_card.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ef0f69a6-7910-4fc8-8514-16394dd84baf/96794594948.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d5acf7c-441b-4503-91fc-28352d6ca6eb/benazusot.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f17921c3-cf1b-41a1-9482-249499cf9e2f/irregular_adverbs_of_manner_list.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0a49071-c127-4357-8725-c654ade4637a/optiplex_390_network_drivers_windows_7.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8afbfd42-9f10-428b-b6ff-8fcdcb589549/sp_racing_f3_deluxe_gps.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99727eb0-3643-4e9e-afd8-f8a0062cb36c/nedagixoridinonedes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6b8099ec-cf75-421a-a73b-b4d5deb031f3/kilunaluxitu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010349.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10349 | 5164 bytes |
SHA-256: 641d59727aa759cb3b062446dd104d7d263d0d6b3a55c112a1999c6447a7d583 |
|||
font_01_sfnt_off000114b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x114B9 | 3716 bytes |
SHA-256: 4e69b7a87c055bce44f1e4696d48b84eaa309c3ec4641805be0516dde77fd6ac |
|||
font_02_sfnt_off000123f4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x123F4 | 10904 bytes |
SHA-256: 3ff785a66237dd56e6b328107cbdfc13d49cae9f4f315ba279507da2acee3d86 |
|||
font_03_sfnt_off0001489b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1489B | 16036 bytes |
SHA-256: 52db30b66cfb76898988bc7c6ed152514c301740808ab95bec9c68e49df23550 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.