MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9402
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/aws?utm_term=vinagre+blanco+para+perder+peso PDF link annotation
- http://devedilazabu.medianewsonline.com/6891146582.pdfIn PDF document text
- https://cdn.sqhk.co/mozigizax/bDCgfkL/39022524177.pdfIn PDF document text
- https://cdn.sqhk.co/zesonixiv/dSrM5dr/unicorn_notepad_with_password_apk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383146/normal_6018f082660e9.pdfIn PDF document text
- http://dezimazokuxulil.mygamesonline.org/aut_aut_kierkegaard_download.pdfIn PDF document text
- http://wugupomovupa.sportsontheweb.net/virikibimon.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4494669/normal_604761b8d41ba.pdfIn PDF document text
- https://cdn.sqhk.co/talokelom/Mjdv8hb/96202640023.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365634/normal_602811ac2b39f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4471092/normal_5ff0a3fdbf2ca.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490251/normal_601872f78ade7.pdfIn PDF document text
- https://cdn.sqhk.co/geruxibab/gfidZ5V/gubos.pdfIn PDF document text
- http://virivuluk.getenjoyment.net/drinking_alcoholic_beverages.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://vawanumezal.onlinewebshop.net/jikaliguvutosoviraxifob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fa5545bb-9b24-4828-ac75-cb91f31f89ed/750609498.pdfIn PDF document text
- http://rulamiji.onlinewebshop.net/what_is_meant_by_self_reliant.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6ea5563-8929-4ddc-9a3c-5076483d5378/mecha_manga_art.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb7aed3c-e6a3-48c5-a745-fe27efdebb4d/how_to_fix_my_schlage_keypad_lock.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75a95593-6b23-4dae-a3eb-5a45df562051/wodudilokuligebamiruxofe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2435b0b-4c3b-4998-98b8-ef381d2cc505/wouxun_kg_uvd1p_service_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/00bae385-b5aa-48cf-ad61-797b7654c372/hoover_windtunnel_air_lift_upright_vacuum_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af11d35e-526b-4753-a998-4f5706dea2b3/polopesesefafetegisafe.pdfIn PDF document text
- http://xovolefewawex.atwebpages.com/made_to_stick_concrete_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d27f9394-d6ec-4374-8a03-b2afa6900e0c/kalakabe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b15a08bd-4214-4f0d-bb54-3b242b5f6340/kroger_blood_pressure_monitor_error_3.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ea5a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEA5A | 5344 bytes |
SHA-256: fb4802b73d8cb5fc9f35a47ebc510d1ba4223335c6242d1655b8eb381e2ddb19 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.