MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a large number of external links, identified as a link farm. Several heuristics, including ML classification and ClamAV detection, indicate malicious intent. The primary purpose appears to be directing users to potentially malicious or SEO-manipulated content hosted on numerous external domains.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=the+undercover+economist+pdf+chapter+1 PDF link annotation
- http://reduslim-italia.website/minecraft_download_unblocked_google8wajn.pdfIn PDF document text
- http://supermagazforsale1.xyz/dojojudepiposibovutosbn6t.pdfIn PDF document text
- http://myfavoritesun.xyz/microsoft_powerpoint_template69j3n.pdfIn PDF document text
- http://buxeletifexid.medianewsonline.com/bulletin_de_salaire_vierge_2020.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368238/normal_600f82ffa2979.pdfIn PDF document text
- https://xotomunekezej.weebly.com/uploads/1/3/1/0/131070571/132e3d3c8d.pdfIn PDF document text
- http://probnik1313.tech/70572397695pcxua.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408340/normal_6024cb469377e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4408476/normal_5ff31bab3efd9.pdfIn PDF document text
- http://hookup673.site/agent_vinod_hd_movie_freewseau.pdfIn PDF document text
- https://risonozolediwar.weebly.com/uploads/1/3/1/3/131398017/7793936.pdfIn PDF document text
- http://technodom11.com/website_icon_pack7913q.pdfIn PDF document text
- https://pogunokele.weebly.com/uploads/1/3/0/7/130739789/3354881.pdfIn PDF document text
- https://fegenogo.weebly.com/uploads/1/3/5/9/135981842/lojevomonopasuk.pdfIn PDF document text
- http://iranianvc.com/medejuvigaxojutare8w1cs.pdfIn PDF document text
- https://xedaliwim.weebly.com/uploads/1/3/1/4/131454603/2bbc236.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://tizexazebubo.atwebpages.com/benzaldehido_usos.pdfIn PDF document text
- https://05e27880-d5e1-4d3d-8428-ba943e9300bc.filesusr.com/ugd/b56239_5e3b758337fc4cada46a37a7e24c8e0c.pdf?index=trueIn PDF document text
- https://55f5e71c-5f54-469f-9449-301c43944234.filesusr.com/ugd/bbdb65_3678ae565a74445c827779c82a591e5e.pdf?index=trueIn PDF document text
- https://314a97e4-cc7b-499c-a999-42b15fb65c39.filesusr.com/ugd/fa4a73_2cd6bce075d8455c9f1ef1bb1722896d.pdf?index=trueIn PDF document text
- https://d6504552-49b0-4b7d-b1ff-94f9e1082b83.filesusr.com/ugd/1f0558_68ac40b9746d4c58bdc0b5f09e6a0edb.pdf?index=trueIn PDF document text
- https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_e696056bb1234edfba370f0199dea1dc.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010c42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C42 | 5424 bytes |
SHA-256: d1df9ffdd2851c8e070355256aeae4cf808a4c5876efa59e182d907ac3dd18a7 |
|||
font_01_sfnt_off00011e96.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E96 | 11404 bytes |
SHA-256: 77044d726cb3bf352d49157eb1f3ccfcbf347c35362237ee817bab588fba9f6b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.