MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by a machine learning classifier and ClamAV. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. One of the extracted URLs, https://baarspo.ru/wix?keyword=rad+sportz+kayak+rack+uk, is likely part of the lure. No scripts were extracted, but the presence of numerous external links indicates an attempt to redirect the user to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/wix?keyword=rad+sportz+kayak+rack+uk PDF link annotation
- http://kevarusakoko.mypressonline.com/2017_scag_tiger_cat_2_review.pdfIn PDF document text
- http://bovewitavivebu.getenjoyment.net/9851957042.pdfIn PDF document text
- http://wutanumijejol.sportsontheweb.net/2017_ford_super_duty_service_advancetrac.pdfIn PDF document text
- http://fakurivevid.scienceontheweb.net/ranujulibixepuje.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://futikuzita.onlinewebshop.net/what_monsters_are_in_the_monsterverse.pdfIn PDF document text
- https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_ed020092af8944c9b15fcc27c53b547c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d7033616-2480-4636-9807-2fa36123ad1b/pasonuxogubetejazafuvoda.pdfIn PDF document text
- https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_b3305ad4a9ec4fec9e8943c8ab9afca3.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zexozavo/vetozeveperer.pdfIn PDF document text
- http://kakasis.onlinewebshop.net/sparknotes_love_in_the_time_of_cholera_chapter_3.pdfIn PDF document text
- http://miganuvag.myartsonline.com/our_night_sky.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ccd14071-63f2-4e15-986d-2d6fb8573d28/tedefixis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d58b76d-0935-4ff4-9d9f-b8a46efac681/94929452666.pdfIn PDF document text
- https://2aa89031-56ac-4de1-b828-aabe99840ec8.filesusr.com/ugd/cf14a4_db77682f95ce424d8513cc51300dd6f7.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zobuwubedak/rca_dvd_home_theater_system_setup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8355f98-ff66-45e5-aa47-455856b78c50/zebogamaz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46d76313-30a3-480a-8bc8-0adc4c3d9119/replacement_parts_for_porter_cable_nail_gun.pdfIn PDF document text
- https://s3.amazonaws.com/kakef/hiking_iztaccihuatl_without_a_guide.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eec0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEC0 | 4868 bytes |
SHA-256: 0703f60c61a969428f1169c1aaec0f3d6bc7f31d701311acf477de6896898e81 |
|||
font_01_sfnt_off0000ff76.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF76 | 9876 bytes |
SHA-256: 49226eb565828a43f329bc7dc6c3580d27356296cfa609eb7f7b40faa2c2de3a |
|||
font_02_sfnt_off00012138.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12138 | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.