MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/award?keyword=bacillus+thuringiensis+control+biologico+pdf PDF link annotation
- https://cdn.sqhk.co/resilano/b5DEpCa/71981486101.pdfIn PDF document text
- https://cdn.sqhk.co/vusutesilo/CMjjTgj/photo_collage_gift_ideas_pinterest.pdfIn PDF document text
- https://cdn.sqhk.co/biwufudi/e8geGjg/folomazefe.pdfIn PDF document text
- https://babixugopanodip.weebly.com/uploads/1/3/5/3/135382952/9842861.pdfIn PDF document text
- https://vamotavobepud.weebly.com/uploads/1/3/1/4/131438348/raredimememibukegaw.pdfIn PDF document text
- https://xipejefokodidub.weebly.com/uploads/1/3/4/6/134612454/7682400.pdfIn PDF document text
- https://cdn.sqhk.co/zafupusapun/47igPO5/wabos.pdfIn PDF document text
- https://xuwojuzo.weebly.com/uploads/1/3/4/4/134471705/b19359fd.pdfIn PDF document text
- https://cdn.sqhk.co/jarixizotib/gjRsfge/iphone_x_ringtone_full_sound.pdfIn PDF document text
- https://nojinogexosop.weebly.com/uploads/1/3/4/6/134695112/dbca556762af.pdfIn PDF document text
- https://cdn.sqhk.co/jujejorule/Lieyojf/universal_onslaught_card_list_price.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://8dfd47f4-e591-4377-92a3-bdbf91d41e5a.filesusr.com/ugd/a58b01_7595a027d6b245938068162f3fd22c7f.pdf?index=trueIn PDF document text
- https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_41da6be0ba124510b8abbce76e0a9d0e.pdf?index=trueIn PDF document text
- https://db244590-af71-4c33-bd6e-2f8f55f31281.filesusr.com/ugd/fdab61_9ef50a7ea808431a8679399ab99af9bb.pdf?index=trueIn PDF document text
- https://229c3593-bb94-4e5d-9b9f-ca3747df48ef.filesusr.com/ugd/145364_72ab0b9ad16c4bf394feff13ae164a17.pdf?index=trueIn PDF document text
- https://9df6fdd8-df71-43fb-87ad-b121b2de7416.filesusr.com/ugd/e0d0cf_d8198be787044415bfe411070cdaa931.pdf?index=trueIn PDF document text
- https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_2f0ad776b103433f90492adf1e3a22da.pdf?index=trueIn PDF document text
- https://8e0cabef-d481-4215-b437-8a5fc4e4723c.filesusr.com/ugd/f41140_35b5ab029a474d6d8ccfc8500e746bd7.pdf?index=trueIn PDF document text
- https://20097937-9b7a-4da4-851c-33e9a8906939.filesusr.com/ugd/1e3518_77f4ce7c3d2a4fdd9b20afc8c6efc83a.pdf?index=trueIn PDF document text
- https://3e1ae61b-6b68-46dc-8a90-d1c7a5b9f91c.filesusr.com/ugd/b8bbd7_11d605d586404e87bcaa0d567dcea863.pdf?index=trueIn PDF document text
- https://4461694d-a6f7-4a69-895a-ff5ddeb3c622.filesusr.com/ugd/f504fb_bc72a65547f44c34b459b21edd08c72a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f6fe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6FE | 5604 bytes |
SHA-256: d3b57f0a40faeb24483e5f70842027e0d2a8b22578504778d6f3b270c1409e91 |
|||
font_01_sfnt_off000109fc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109FC | 11596 bytes |
SHA-256: 0133f77aa65386a17f3344eb6a9c41042fcfc5e15b1931ca2ac7b3b170dedce4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.