MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or spam campaign. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or redirection to malicious content. The document body is heavily obfuscated and appears to be junk data, but the presence of external URIs and the PDF_SEO_LINK_FARM heuristic strongly suggest the intent is to drive traffic to malicious or spam websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=how+to+be+medical+assistant+certified PDF link annotation
- https://cdn.sqhk.co/penazavoxu/jgghjdo/t_i_hack_mini_racing_adventures_game.pdfIn PDF document text
- https://cdn.sqhk.co/vibisidumes/fjdv5ig/hepatitis_b_symptoms_in_men.pdfIn PDF document text
- https://pujapuvefebawu.weebly.com/uploads/1/3/4/5/134581836/tabudeliviv.pdfIn PDF document text
- https://gupufema.weebly.com/uploads/1/3/4/4/134456882/molupidob-xenuk.pdfIn PDF document text
- https://cdn.sqhk.co/nuvuvidova/jgicjhC/96036790001.pdfIn PDF document text
- https://nobenore.weebly.com/uploads/1/3/2/6/132696051/7281814.pdfIn PDF document text
- http://berizala.22web.org/bizesaxonoduzesiwowav.pdfIn PDF document text
- https://cdn.sqhk.co/wezufunin/MRcQjcw/knife_spinning_skills.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://nomudozagaximat.epizy.com/bridge_over_troubled_water_piano_sheet.pdfIn PDF document text
- http://kirogebi.epizy.com/rifekidagixegav.pdfIn PDF document text
- https://d397443b-80d0-4e74-967c-4ce830ee3754.filesusr.com/ugd/0a76f0_fedd97d7a0ac4821abe9e1f5fdb2a207.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ac3f59aa-d563-4734-a5d9-30575baf83ec/attack_on_titan_character_season_4.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/72b9cf1d-aa84-4c27-8db8-3ff7ef06a5a5/bawewonolezirojixov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/195e2261-6c4e-480c-b50d-9db734746920/38472896208.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b082bf1-a5b0-46d7-8f02-e3dabafc8629/schwinn_airdyne_ad6_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/33c0a187-66f8-43e4-9765-03349f645b12/what_is_the_main_purpose_of_academic_text.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd54296c-6770-4d64-a4f1-bc340cd6bc1a/somawelekareb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a7dccf2-1199-4cc5-829c-306477a5b86e/42487275294.pdfIn PDF document text
- https://dab7fb03-f2af-4a8e-9cb9-31de623bedb3.filesusr.com/ugd/58b596_2ff30bfccedf47968f97f83761686541.pdf?index=trueIn PDF document text
- http://vaviweposaroku.rf.gd/asuran_movie_trailer.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000126e8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x126E8 | 5360 bytes |
SHA-256: 8c2d635d3490d5bd7ef3e5c090209cdd5d1b248cee3fdc27b817459bbe6476b7 |
|||
font_01_sfnt_off00013910.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13910 | 11164 bytes |
SHA-256: 607296caa8d8e950b6452e1491f7c567b8dda7e1b32c6a1e85e1984bfe6acd65 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.