MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are to benign-looking PDF files, suggesting a link farm or SEO poisoning tactic. One of the primary external links, 'https://druttle.ru/award?keyword=bank+rating+methodology+pdf', is suspicious and likely leads to a phishing or malware distribution site. The ClamAV detection and ML classifier further support the malicious nature of this PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9807
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/award?keyword=bank+rating+methodology+pdf
- https://cdn.sqhk.co/firijanab/jeFE7ic/zodugexas.pdf
- https://cdn.sqhk.co/voxobidivel/gfkhdhc/gonodexini.pdf
- https://cdn.sqhk.co/naliwanik/jgQEhj2/wazijurirasapopabi.pdf
- https://cdn.sqhk.co/guzowozuk/ia3CDgj/66327763583.pdf
- https://cdn.sqhk.co/vumuwilaj/djj1nsp/let_s_keep_the_ball_rolling_means.pdf
- https://cdn-cms.f-static.net/uploads/4408984/normal_605fa4dcce759.pdf
- https://cdn-cms.f-static.net/uploads/4380384/normal_603afc1f9c90f.pdf
- https://cdn-cms.f-static.net/uploads/4480904/normal_604c9af467567.pdf
- https://cdn-cms.f-static.net/uploads/4420617/normal_603cacf6073c4.pdf
- https://cdn-cms.f-static.net/uploads/4479212/normal_6032a67ccb9ab.pdf
- https://static.s123-cdn-static.com/uploads/4494146/normal_6008a55cc4686.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/d1b14f5f-56fb-4baa-b0e1-603ef77ddb15/topunawini.pdf
- https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_f760aebc102845889178d3470cbc5f1a.pdf?index=true
- https://uploads.strikinglycdn.com/files/975fe1e5-69cd-4fee-9e3a-311580973c51/jigofipovivitokejubejoja.pdf
- https://cd753cf5-d90a-4073-9c55-931a76e81761.filesusr.com/ugd/8826df_a666fcb830b44d88883ca0cb1d15b514.pdf?index=true
- https://ef2e072a-e8a2-4438-804d-cc750be2e2f6.filesusr.com/ugd/6a22cb_a55f4601056d43e69a488e43311a2289.pdf?index=true
- https://uploads.strikinglycdn.com/files/02d0c3ac-4716-48f7-b109-4003a0ad9c08/7_habitos_de_la_gente_altamente_efectiva_audiolibro_descargar.pdf
- https://uploads.strikinglycdn.com/files/23259f8d-f35b-45db-be60-93b836995f4f/43525893535.pdf
- https://uploads.strikinglycdn.com/files/7aa95002-9db8-48b9-bab6-a9b07ff2df42/saletokoxalofazalizivexi.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010714.bina92327c6dbb1adcb7c5952165796c3a1acd66dccfe082d53974bb5d6cabc9d11 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10714 | 5492 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.