MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/123?utm_term=wood+dining+table+with+iron+legs PDF link annotation
- http://ashotik.space/pukoletawijabasupemurunora6dxb.pdfIn PDF document text
- http://topcreditcheck.info/percy_jackson_and_the_olympians_the_lightning_thief_movie_google_driveod358.pdfIn PDF document text
- http://hangookoil.ru/ramovuxc86c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366309/normal_5fdb6a52037a2.pdfIn PDF document text
- http://takipleskazan.org/kirkland_signature_spiral_sliced_hickory_smoked_ham_cooking_instructionsf7x6q.pdfIn PDF document text
- http://meinekarten.best/hunchback_of_notre_dame_songs_musical9y5y7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4420743/normal_5fdd64758cf25.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_2eab34d7f6ba4d1898d05bcee2573b11.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tawosutosuxi/quiz_logo_game_level_15_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d970b329-4177-4745-9f91-09faf3c16828/79683056906.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0150d28f-1488-463c-8721-a4119c4784c4/the_secret_garden_restaurant.pdfIn PDF document text
- https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_21e23d9fe0d742309c5e49222c8a6c97.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7b7dffe9-af41-42ae-9c1e-4e9497c48e56/30293182882.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31b6c9a7-ebea-4551-8d52-65eeb635ba6b/gidanulerafawuxepulo.pdfIn PDF document text
- https://2dc0326d-ac60-47d8-bf46-f2dc9d334570.filesusr.com/ugd/21b4a7_9674b08371b64d40aab665d2503d4531.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jusagi/love_shayari_photos_english.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/98706ee7-cccf-4806-895e-72e2d645597e/zomovowebe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad6ab77a-dfdd-4f8c-b5cf-6423dc3ab30b/60225494547.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed98.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED98 | 5332 bytes |
SHA-256: bf54de3d56d6a7d4c92e83e7ae5a3b51a3ea1995619ccd41a5f45aa70d8c96c1 |
|||
font_01_sfnt_off0000ffc4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFC4 | 11080 bytes |
SHA-256: 7a4c4e0ff305cafbf4de454a1ff2c70c9cb7d8f9b1c4b17c15beda3e43d7051f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.