MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, identified as a link farm. Several heuristics indicate this is a malicious SEO tactic, with ClamAV detecting it as a phishing trojan. The embedded URLs, such as 'https://baarspo.ru/award?keyword=skripsi+akuntansi+keuangan+pdf', are likely used to direct users to malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/award?keyword=skripsi+akuntansi+keuangan+pdf PDF link annotation
- http://raxejudesezix.scienceontheweb.net/roku_soundbar_black_friday_2020.pdfIn PDF document text
- https://semuzotefol.weebly.com/uploads/1/3/1/4/131437619/0f768e0e0a4.pdfIn PDF document text
- http://nexipufogavajid.getenjoyment.net/adapted_physical_education_and_sport_5th_edition_download.pdfIn PDF document text
- http://bositozibab.getenjoyment.net/bh_live_classes.pdfIn PDF document text
- https://vovowiki.weebly.com/uploads/1/3/2/3/132303124/zagufe.pdfIn PDF document text
- http://bravos-kids.ru/lmites_trigonomtricos_con_cambio_de_variable_ejercicios_resueltos9hfpm.pdfIn PDF document text
- http://fikosarodone.medianewsonline.com/behaviour_management_in_schools.pdfIn PDF document text
- http://snapchat-alert.com/taal_mp3_free_downloadt80j9.pdfIn PDF document text
- http://mushygushysayings.com/76465736025e47pc.pdfIn PDF document text
- http://espacecmb.xyz/505305491387mo2f.pdfIn PDF document text
- http://wimuzawoxi.getenjoyment.net/73940351187.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/06cc9a37-6096-4181-906b-8cc877075f93/fotalomadisota.pdfIn PDF document text
- https://2c8134a4-d865-4da1-8961-c755d7242105.filesusr.com/ugd/6dcf04_3fcbc02d9cb84bd4b5d370fecfe0ded6.pdf?index=trueIn PDF document text
- https://0621cc9e-6449-4e8a-a8bd-baee9ad62a2c.filesusr.com/ugd/affb4a_455e895086dc4dd78c4263843c3a9ac2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1d5c8508-0ce8-4d31-9efa-12a4e988413f/zotitosutofozinukupep.pdfIn PDF document text
- https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_ffeed74d423c44b3b85089568c1f26c9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/210d16e0-4ecf-4129-af28-b5bca846f534/clark_forklift_parts_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e7b33b0f-5d9a-46e9-bc70-a3bc2ca70952/92303330478.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4862e01-0299-43a3-95b4-fd755c3894d9/best_self_cleaning_litter_box_2018.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010cf0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CF0 | 5116 bytes |
SHA-256: 31b3dda1f542bbcac5307cc46f7adf319ddfef893213e0aeac81926b2085a807 |
|||
font_01_sfnt_off00011e58.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E58 | 10748 bytes |
SHA-256: de39ed2cac657fd966c762ec520ad201fab66b876d4db068ddd3ada0355367a6 |
|||
font_02_sfnt_off000142e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x142E4 | 4324 bytes |
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.