MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.7728
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://irlanc.ru/pbw?utm_term=does+android+tv+support+airplay PDF link annotation
- https://rawitexebava.weebly.com/uploads/1/3/4/4/134487877/55fb6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423454/normal_603a691cd3121.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381541/normal_6059f750a0407.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482023/normal_605da01aeadda.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469827/normal_605f8b438c2b5.pdfIn PDF document text
- https://bokepamukabina.weebly.com/uploads/1/3/5/2/135293240/d52d82660891.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4463279/normal_60139573a67f0.pdfIn PDF document text
- http://nojewalikar.pbworks.com/f/yepi_3_games_unblocked.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cda03884-b97e-41d9-911a-de2aa8cae6aa/lupus_eritematoso_sistemico_canino.pdfIn PDF document text
- http://ridelox.pbworks.com/f/vaxewugagipozadelo.pdfIn PDF document text
- http://wigonewakil.pbworks.com/f/how_do_i_set_the_time_on_my_pentair_intelliflo.pdfIn PDF document text
- http://nilanom.pbworks.com/w/file/fetch/144585144/la_petite_poule_qui_voulait_voir_la_mer_questions_ce1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c60bacd0-7e20-4330-b950-a092dcdd89a5/nicomachean_ethics_book_8_quotes.pdfIn PDF document text
- http://legesir.pbworks.com/f/mandalas_para_colorear_dificiles_y_bonitas.pdfIn PDF document text
- http://bowawesup.pbworks.com/w/file/fetch/144819324/littons_weekend_adventure_rock_the_park.pdfIn PDF document text
- http://xumamiz.pbworks.com/f/movewagegewerovewurebuna.pdfIn PDF document text
- http://naxenuve.pbworks.com/f/ingilizce_eitim_setleri.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5742efa-a3dc-4312-83f9-7ac2d2dfb033/how_to_winterize_a_mercury_outboard_motor.pdfIn PDF document text
- http://jotuwufo.pbworks.com/f/motorola_apx_7000_charger_manual.pdfIn PDF document text
- http://sorawako.pbworks.com/f/the_norton_anthology_of_american_literature_ninth_edition_citation.pdfIn PDF document text
- http://pefagisunel.pbworks.com/f/55806543915.pdfIn PDF document text
- http://gamaxidad.pbworks.com/w/file/fetch/144539442/participe_prsent_adjectif_verbal_exercices.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/12c73114-253d-49ff-9f3e-619d5788cc0e/how_do_you_play_jeopardy_in_the_classroom.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.