MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. It contains a large number of external links, many pointing to PDF files hosted on Weebly and other platforms, suggesting a link farm or SEO manipulation tactic. One of the embedded URLs, 'https://crewmak.ru/pbw?utm_term=airdroid+apk+android+4.2.2+download', indicates a potential lure for downloading software. No scripts were extracted, but the PDF structure and numerous external links are indicative of a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crewmak.ru/pbw?utm_term=airdroid+apk+android+4.2.2+download
- https://lasubapomi.weebly.com/uploads/1/3/0/7/130776640/gurepupax_nopusajis_tesoposemeb.pdf
- https://gonupedifi.weebly.com/uploads/1/3/4/5/134524362/3577321.pdf
- https://fukuzemuk.weebly.com/uploads/1/3/5/3/135306557/sidegugiw-sinakunu-suxijeparuz.pdf
- https://static.s123-cdn-static.com/uploads/4417429/normal_5fc8966f29678.pdf
- https://cdn-cms.f-static.net/uploads/4483602/normal_6066c7a8807f7.pdf
- https://ledomibab.weebly.com/uploads/1/3/4/8/134858948/nonufunelivogo-gigutow.pdf
- https://tivubolo.weebly.com/uploads/1/3/1/8/131857038/3586341.pdf
- https://static.s123-cdn-static.com/uploads/4489607/normal_5fdfb2907f6af.pdf
- https://faloxumotib.weebly.com/uploads/1/3/4/6/134646793/bulofobifege.pdf
- https://cdn-cms.f-static.net/uploads/4469841/normal_603b2cfec1e64.pdf
- https://static.s123-cdn-static.com/uploads/4391634/normal_5fe5d995aa548.pdf
- https://vaseviga.weebly.com/uploads/1/3/3/9/133986607/wapirofezuse-lugosepivat-ropeluso.pdf
- https://rajoligegade.weebly.com/uploads/1/3/4/5/134504333/fuzede.pdf
- https://xegejigavo.weebly.com/uploads/1/3/4/8/134883842/c557812c129d65.pdf
- https://gawotajar.weebly.com/uploads/1/3/4/5/134525297/2138137.pdf
- https://lotigasi.weebly.com/uploads/1/3/4/7/134705720/3027831.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/246f6015-7c4a-4e81-94b6-ce302455a43b/93718460360.pdf
- https://uploads.strikinglycdn.com/files/11d78282-0c03-4814-a747-5d5603798b83/acurite_pro_weather_center_manual.pdf
- https://uploads.strikinglycdn.com/files/27213297-492f-4df5-a6c3-b7bbf82c669b/what_is_the_best_coordinate_to_find_diamonds_in_minecraft.pdf
- https://uploads.strikinglycdn.com/files/9d821a1e-d704-4a57-8fa5-6aa76d35bd59/yamaha_rx-v2400_manual.pdf
- https://uploads.strikinglycdn.com/files/d73ef592-3198-4cfb-b8e6-6f08bdf14b82/good_questions_to_ask_students_on_the_first_day_of_school.pdf
- https://uploads.strikinglycdn.com/files/f0001496-431f-404e-8cf0-27809f603fa9/how_to_port_google_voice_number_to_metropcs.pdf
- https://uploads.strikinglycdn.com/files/8d204420-6d4e-4b58-883c-d79088a9a1c4/how_can_we_help_the_sumatran_tiger.pdf
- https://uploads.strikinglycdn.com/files/0b3dc095-c821-46e0-958d-ab6edc934353/what_ply_is_red_heart_comfort_yarn.pdf
- https://uploads.strikinglycdn.com/files/69bfa9b2-0be3-4e23-bab1-81c97e6d70dd/how_to_set_low_battery_warning_on_iphone.pdf
- https://uploads.strikinglycdn.com/files/6a18ae1a-12c0-49d5-b6a1-31d2d95ee48f/traductor_espaol_portugues_en_linea.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001092e.bine11c5e1e2a4fcffe5a6dad8a0345d466570649777c8ae457b1f0cee5aefe62c5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1092E | 5172 bytes |
font_01_sfnt_off00011af9.bin63e766c1e6e6f950d78477abad90b3bc0b7b523ccbfdc6187b9cb727874c41b3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11AF9 | 10756 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.