MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The presence of a 'utm_term' parameter in one of the URLs indicates a potential phishing or tracking mechanism. ClamAV detection and ML classification strongly indicate malicious intent, likely for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/strik?utm_term=sony+sa-ct60bt+remote+control PDF link annotation
- http://vashobereg.com/romeo_and_juliet_summary_act_1_to_act_3vyppd.pdfIn PDF document text
- https://samituvejasuw.weebly.com/uploads/1/3/1/4/131406365/320f450115d2435.pdfIn PDF document text
- https://bejuzozomixur.weebly.com/uploads/1/3/5/9/135966319/cb99a5fc5d03a.pdfIn PDF document text
- http://energierecrute-emplois.com/ocean_racing_surf_skifvyb8.pdfIn PDF document text
- https://sonoxezepokamev.weebly.com/uploads/1/3/3/9/133999938/b261abb4836f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://4ac36a2f-1533-488b-b282-cf34cdace458.filesusr.com/ugd/bcfc12_c59a3a24306042f394a43fac44d60abf.pdf?index=trueIn PDF document text
- https://fc06435f-e709-4c80-b59d-96fa470c1a13.filesusr.com/ugd/bdc04d_02b500a378204114992b3b92576f231a.pdf?index=trueIn PDF document text
- https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_7b25dc52811d447d9ce41bf5e77f027a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kewuxejikiwe/73207614421.pdfIn PDF document text
- https://7c3dd69e-6649-485e-b385-36acc2971cd6.filesusr.com/ugd/cf9ff1_e6b09bf313f545eaa42006e8d57f8a74.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c86cd6d5-705f-4914-961c-e3107fef3159/canon_mx430_scanner_drivers.pdfIn PDF document text
- https://27158da8-170d-48ca-a528-b8ced62fe517.filesusr.com/ugd/9fc8c3_7f0b9c17283549759caae234fc973a8c.pdf?index=trueIn PDF document text
- https://949217f6-ecfc-4a1b-8806-967b2a145102.filesusr.com/ugd/b08fd2_7f09a7a3fb764e48b24b322a603827de.pdf?index=trueIn PDF document text
- https://9d50af6f-dbf7-41ba-b854-83985329a12b.filesusr.com/ugd/33c377_01f04347ba6c42c782500aea13b3efb1.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/601f2b95-bad0-4c7a-9836-d44ddf3bd9b3/gopro_hero_3_charger_cable_type.pdfIn PDF document text
- https://s3.amazonaws.com/lokijuronig/jaminadetalipufalekeka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9311d0f-a47f-4329-9a4d-72636340e771/46300193157.pdfIn PDF document text
- https://s3.amazonaws.com/fevobelijogal/flirty_good_morning_texts_to_send_a_girl.pdfIn PDF document text
- https://fdb4f28e-c637-431f-967d-457feef73efb.filesusr.com/ugd/cf5aa9_464b4e9d73c045ae89d18683af72cfd7.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4d5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4D5 | 5616 bytes |
SHA-256: c14cd6bfd9d60a010e7f462ed15c078ac79b20b4ce0066367d844561a1e6ea8e |
|||
font_01_sfnt_off0000f7de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF7DE | 11416 bytes |
SHA-256: ad1e03a27bef21125d39852b7a520bef0c6455cca14f76906c4ffe6d9653c08a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.