MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document contains a large number of external links, identified as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or distributing further malicious content. The document's purpose appears to be directing users to a network of other PDFs, potentially for SEO abuse or to host malicious payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cdn-cms.f-static.net/uploads/4459917/normal_603b0f2f55667.pdf
- https://static.s123-cdn-static.com/uploads/4405899/normal_60010bdfe8af2.pdf
- https://cdn-cms.f-static.net/uploads/4450639/normal_60bd3af38d995.pdf
- https://cdn-cms.f-static.net/uploads/4459636/normal_602d3c6399534.pdf
- https://cdn-cms.f-static.net/uploads/4501380/normal_6026e12f8f4ac.pdf
- https://cdn-cms.f-static.net/uploads/4402262/normal_606b6014d0e43.pdf
- https://pajobozonojamu.weebly.com/uploads/1/3/3/9/133997184/gowoxipowuvibid.pdf
- https://dezekebewefe.weebly.com/uploads/1/3/4/7/134731304/bumikozopakuverusix.pdf
- https://jawokisejul.weebly.com/uploads/1/3/4/6/134601468/46fdeb43f2.pdf
- https://static.s123-cdn-static-d.com/uploads/4502920/normal_60b04d356e96f.pdf
- https://cdn-cms.f-static.net/uploads/4421200/normal_6014e19675224.pdf
- https://cdn-cms.f-static.net/uploads/4376625/normal_605ef76c51a85.pdf
- https://cdn-cms.f-static.net/uploads/4385230/normal_6028e507e5597.pdf
- https://rofaxebawo.weebly.com/uploads/1/3/4/7/134750080/bagebe-nizilabuku-kiwulo-puvifidufed.pdf
- https://static.s123-cdn-static.com/uploads/4415309/normal_5fc79aff6e249.pdf
- https://static.s123-cdn-static.com/uploads/4486983/normal_5fcaa0e3bf078.pdf
- https://fasanisig.weebly.com/uploads/1/3/0/7/130739318/fb88e1439cef.pdf
- https://cdn-cms.f-static.net/uploads/4409238/normal_606ab1828bf6a.pdf
- https://kasikijafeke.weebly.com/uploads/1/3/1/4/131406722/2075828.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/sq/ugae/~3/4P1vZUbBa90/square?utm_term=attention+to+detail+interview
- https://uploads.strikinglycdn.com/files/0fa9d64c-e564-40dd-963f-fb97403d7f73/80387335361.pdf
- https://uploads.strikinglycdn.com/files/404105da-b2e4-467a-b880-8c78278ba330/landice_l7_owners_manual.pdf
- https://uploads.strikinglycdn.com/files/09527d9b-3f53-41bd-8174-2a7d86a2f143/xuzolapofa.pdf
- https://uploads.strikinglycdn.com/files/d51ef6ae-70a3-444c-90b9-58f8d77c4ffe/why_is_my_versa_2_not_connecting.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e70e.bin4c9d46ddd7b08e009ebe10c9e1902b3c87ee77af50aa4db2512b1528b01c1db8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE70E | 4784 bytes |
font_01_sfnt_off0000f772.binbdbc1301aaf6595ac95a65514c13228f673fb29f9cea6a5b28eab6f4211fe523 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF772 | 10848 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.