MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable domains, indicating a link farm or SEO manipulation scheme. ClamAV detected it as Pdf.Phishing.Trojan, and ML classification strongly suggests maliciousness. The embedded URLs and the heuristic firings for PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM support the conclusion that this document is part of a malicious campaign, likely for phishing or SEO spam.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=total+war+warhammer+2+von+carstein+guide PDF link annotation
- http://lovemecompletely.com/ecg_report_says_sinus_rhythmgieac.pdfIn PDF document text
- http://like-store.site/ar_blue_clean_ar383_o-rings_size3fg6r.pdfIn PDF document text
- http://rowowesofazov.medianewsonline.com/ludevofuneme.pdfIn PDF document text
- http://reflectionss.space/how_to_do_cognitive_behavioral_therapy_cbt2tn04.pdfIn PDF document text
- https://mipolapepel.weebly.com/uploads/1/3/4/3/134395859/tuxofitiwetuzexuraka.pdfIn PDF document text
- https://divaruwidis.weebly.com/uploads/1/3/4/0/134042650/a7a14a4.pdfIn PDF document text
- http://azalea.store/washington_football_team_record_2018bbbio.pdfIn PDF document text
- http://calipshatngaccs1.xyz/95402210575lidup.pdfIn PDF document text
- http://metryck.info/3951808922yped5.pdfIn PDF document text
- https://vikisoxez.weebly.com/uploads/1/3/4/7/134712259/ad784f.pdfIn PDF document text
- http://wodedutipif.medianewsonline.com/why_did_my_thermostat_go_blank.pdfIn PDF document text
- https://vebafuxitupum.weebly.com/uploads/1/3/4/8/134890404/6637642.pdfIn PDF document text
- https://tumipipap.weebly.com/uploads/1/3/4/5/134598024/lelaxosazed.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_30ead80a7a464af89cca83b974dc15f1.pdf?index=trueIn PDF document text
- http://wenibeliso.atwebpages.com/strategic_management_in_marathi.pdfIn PDF document text
- https://329f26c8-0235-4118-8622-173d264d9cf1.filesusr.com/ugd/221f3a_de831999f1b544f6a71595d9841e2140.pdf?index=trueIn PDF document text
- https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_e81adfe1cdec4691bc00c4e6bfdb89e0.pdf?index=trueIn PDF document text
- https://15319a82-8c66-4906-b3c2-464277991f2b.filesusr.com/ugd/070acf_b9e0da37ca5b4d7a8fe3bd5ebd04f78b.pdf?index=trueIn PDF document text
- https://8ab1a2d5-e5b1-44c5-a28c-e09959565f0d.filesusr.com/ugd/eb712c_8c14da1eef6c4e748a4600c1bef58c0c.pdf?index=trueIn PDF document text
- https://b9387e75-0942-48a6-8a47-0bd3f0224277.filesusr.com/ugd/fc485c_f600e310ac0343c7b19c06b18babb70e.pdf?index=trueIn PDF document text
- https://492f55f4-3442-4b37-b17e-39d9f2f0ae8a.filesusr.com/ugd/7dfe85_cf53ab8db01a439083fd43bb33b8141d.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000125ad.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125AD | 5468 bytes |
SHA-256: dbe965e2e9dff904c0098514b0f89c76a9f3eafa70696a217c1bf6a800189f97 |
|||
font_01_sfnt_off00013835.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13835 | 11044 bytes |
SHA-256: af31966f263cc29b8bd58281e0a21a044ae4e4992aad87023abb54ab72915847 |
|||
font_02_sfnt_off00015dbf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15DBF | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.