MALICIOUS
134
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a link farm with numerous external URLs, many of which point to potentially malicious PDF files. The 'PDF_SEO_DISPOSABLE_LINK_FARM' heuristic indicates a deliberate attempt to obscure the true malicious intent by distributing links across many domains. ClamAV detection and ML classification strongly suggest malicious content, likely a phishing or trojan delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.9928
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://aquitaine.annuaire-regional.com/ckfinder/userfiles/files/89994056558.pdf
- http://csim.jp/ckeditor/uploads/files/juguzudofidovivup.pdf
- http://www.theagentpipeline.com/wp-content/plugins/formcraft/file-upload/server/content/files/16138473f65f97---24625941006.pdf
- https://palcev.ru/userfiles/file/rebogiredudazopanotakane.pdf
- https://fu-ko-property-agency.com/webroot/editor-uploads/files/79803312261.pdf
- http://xn--c1aejbdnke.xn--p1ai/admin/ckfinder/userfiles/files/mokiwunox.pdf
- http://es-manzokudou.com/yamituki-n/uploads/files/vidadomuxelumijob.pdf
- https://netcsemege.hu/ckfinder/userfiles/files/sekarekuso.pdf
- https://interference.ajoda.eu/userfiles/files/bememivivikobugobigopab.pdf
- https://tootooair.com/FileData/ckfinder/files/20210902_545EE1C6A1A12394.pdf
- http://elitakhealing.com/ckfinder/userfiles/files/30983730188.pdf
- https://podimercrm.com/img/files/tamememif.pdf
- https://festivaldelmaridaje.com/sgi_userfiles/userfiles/files/53371278504.pdf
- http://uspeh-kursk.ru/ckfinder/userfiles/files/tozobibo.pdf
- http://cathyknightwaite.com/ckfinder/userfiles/files/wetosozetopidusugexozeted.pdf
- http://www.scsk12.org/policy/files/files/20400438871.pdf
- http://gd-weimi.com/upfolder/e/files/20210903065859.pdf
- https://gresathouse.com/wp-content/plugins/super-forms/uploads/php/files/81851f0d5cc93edba40398fff73231c6/dovuzifogilopafen.pdf
- https://cpsguffanti.it/uploads/file/dexutajixoliwuk.pdf
- http://sushistoryus.com/uploads/files/1061582599.pdf
- http://thetestmag.com/userfiles/files/zotozasevi.pdf
- http://delta-serwis.pl/pliki/jovikenumagago.pdf
- http://pantanalmsnews.com.br/ckfinder/userfiles/files/41426236420.pdf
- http://urotunisia.com/uploads/FCK_files/file/45938119295.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=best+free+hidden+call+recording+app+for+android
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001240a.bin208c696818a4817e362206fccfd4ca92bde13d8d2dddb2c25ad19efea722e7f6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1240A | 17920 bytes |
font_01_sfnt_off000152bf.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x152BF | 16792 bytes |
font_02_sfnt_off00016ad6.bin6f0c779f5b472f6f4b73db709d4ca024dad116a43ef2270cc0359395a052ee17 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16AD6 | 10952 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.