MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=what+is+a+tecumseh+engine PDF link annotation
- http://zupezejukiselu.22web.org/84124458399.pdfIn PDF document text
- https://cdn.sqhk.co/kewawukufiju/ff2ihDL/dinosaur_world_florida_map.pdfIn PDF document text
- https://xiwapidijiz.weebly.com/uploads/1/3/4/5/134511693/2e62e79cc69e.pdfIn PDF document text
- https://cdn.sqhk.co/vatukaso/jahhHBg/wevowurimeviwenotewer.pdfIn PDF document text
- http://zuwaweno.iblogger.org/types_of_asexual_reproduction_in_animals.pdfIn PDF document text
- https://vupagivoro.weebly.com/uploads/1/3/4/3/134314863/dunugibatum_zorusiviberufe.pdfIn PDF document text
- https://jatojuji.weebly.com/uploads/1/3/4/6/134649995/9b0227056c35ba.pdfIn PDF document text
- https://ruxibini.weebly.com/uploads/1/3/2/6/132680870/98f9bc.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://sewasijibakel.epizy.com/daily_activities_printable_worksheets.pdfIn PDF document text
- http://tuguwobafadurot.rf.gd/24461786622.pdfIn PDF document text
- https://0e098354-e5d1-4afc-9be7-763a70ae5e44.filesusr.com/ugd/ef253e_3f2331e80b234e5192e603311c5021bb.pdf?index=trueIn PDF document text
- http://ziwawadu.rf.gd/zalewebav.pdfIn PDF document text
- http://mutezojujamanu.rf.gd/60616202963.pdfIn PDF document text
- https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_a4bb7bfbb3ba4f068edb834b0db8d00e.pdf?index=trueIn PDF document text
- https://cc968bdf-8a18-4a65-a72d-893c706ef441.filesusr.com/ugd/bae363_0a4af897f4884631b7bbd893d4051711.pdf?index=trueIn PDF document text
- http://vavilonogamet.epizy.com/72519619016.pdfIn PDF document text
- https://4b5f4e46-8b81-4257-bf39-61fc08ba57b0.filesusr.com/ugd/7ea8bb_0a792ff8ff7f44c4967966c5e1d187b7.pdf?index=trueIn PDF document text
- http://filivuso.rf.gd/how_to_find_the_slope_intercept_given_two_points.pdfIn PDF document text
- http://nekodigeteremi.rf.gd/8683066024.pdfIn PDF document text
- https://cceb078e-1df6-42b0-9e12-359f30e42f1d.filesusr.com/ugd/e8506d_e08e098df2cb4223bec74fed9b0d3aeb.pdf?index=trueIn PDF document text
- https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_e73f5d02b34745e79ba949fbce1c9d69.pdf?index=trueIn PDF document text
- https://dae57379-2785-4108-a223-4562ecbfc22e.filesusr.com/ugd/87ad98_17a53dadc89340f6a85900e1066a58f4.pdf?index=trueIn PDF document text
- http://radodazemiluk.epizy.com/backuptrans_android_iphone_viber_transfer.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d580.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD580 | 5100 bytes |
SHA-256: 4211b6defebb239484d9a62b09236cc78ab7b0e79d19be39611805a38862f4b5 |
|||
font_01_sfnt_off0000e6c5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6C5 | 10432 bytes |
SHA-256: 0cf1a1948b3780aed1e417f5f2717660c2fdec6e8f04fd3ac814c959a6fd4af3 |
|||
font_02_sfnt_off00010ad4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10AD4 | 16204 bytes |
SHA-256: e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.