MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many pointing to disposable domains, suggesting it functions as a link farm. The primary URL, 'https://gimoguvi.ru/award?keyword=gujarati+barakhadi+with+pictures+pdf', is likely a lure to attract users searching for specific content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or distributing further malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://gimoguvi.ru/award?keyword=gujarati+barakhadi+with+pictures+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4471719/normal_5fdad77ad6688.pdfIn PDF document text
- https://cdn.sqhk.co/pasepizut/hhgL2Rv/one_deck_dungeon_steam_key.pdfIn PDF document text
- http://domotoj.sportsontheweb.net/25271124558.pdfIn PDF document text
- https://vedixoba.weebly.com/uploads/1/3/4/8/134864822/04ffeba647.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4377101/normal_603c5b347fa49.pdfIn PDF document text
- http://kalukawuwo.mygamesonline.org/70932892908.pdfIn PDF document text
- https://nudatisuwirok.weebly.com/uploads/1/3/1/3/131384101/8237339.pdfIn PDF document text
- https://cdn.sqhk.co/mugolino/Jiagfgc/scary_clown_man_neighbor_escape_apk.pdfIn PDF document text
- https://jaxedafotonomut.weebly.com/uploads/1/3/4/8/134885779/bajipalivak-wojuwogepewobab.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.indictrans.orgIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/4815f3d9-ca0e-4d83-8a82-a442defc8513/the_best_combat_knife_ever.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1edd077d-c8a5-45e2-805e-2fbca4af1d10/25125726287.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6dd11808-dcbf-4631-957c-deca752d5006/98380609530.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f544c50-cf9e-49ce-a680-5a21fb2ea874/78006737877.pdfIn PDF document text
- https://7f1d4f38-7308-4051-b389-b8ed31312188.filesusr.com/ugd/e948c1_53004b8001224ab084d63af6a2a16e6c.pdf?index=trueIn PDF document text
- https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_6434b7c29766462e8188f1e569b9af59.pdf?index=trueIn PDF document text
- https://c3a7a64c-5591-430b-94d7-c2eadfdf3523.filesusr.com/ugd/966478_921ad11e98854d2b89474f58faf72f7e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ded50892-83d8-4116-b4ba-8c1913ada55f/80204713373.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c45c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC45C | 5280 bytes |
SHA-256: a6a2183b319a5ab9e75bdc1e85177d816214fb0b41952ba579ad6c7a7cbc5f10 |
|||
font_01_sfnt_off0000d67d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD67D | 4500 bytes |
SHA-256: 77eb01f8342988cc4719df0645e437f85cd1b41d15d0188dafe3e807c706b082 |
|||
font_02_sfnt_off0000e4bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4BC | 10388 bytes |
SHA-256: 70390b2bf51712d5f158c68c9ef1078fa4e00eb37da2c4fd18de6f56ab6032c0 |
|||
font_03_sfnt_off00010845.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10845 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.