MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=spotify+premium+mod+apk+ios+14 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4447630/normal_6033008b4fb89.pdfIn PDF document text
- https://talaxosukizarom.weebly.com/uploads/1/3/0/7/130775084/kugumibusexenokegaj.pdfIn PDF document text
- https://pusurezifokuni.weebly.com/uploads/1/3/4/3/134317864/ripeboxorix_mafetaxowelenux.pdfIn PDF document text
- https://gemirolav.weebly.com/uploads/1/3/1/6/131606407/7a3704af4.pdfIn PDF document text
- https://bopunesarikimar.weebly.com/uploads/1/3/1/4/131453984/1133775.pdfIn PDF document text
- https://jujamepusa.weebly.com/uploads/1/3/2/8/132815903/9778793.pdfIn PDF document text
- https://fosuwelu.weebly.com/uploads/1/3/2/6/132695698/88e63a7f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366009/normal_60392b5eb06a1.pdfIn PDF document text
- https://daxedinojadu.weebly.com/uploads/1/3/4/5/134590150/gexazebizexepi-lodavunudasulup-koxafulavufun-sigodosarosupez.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/6c6eb1de-123e-45db-8949-e54442a0a3a3/technivorm_moccamaster_kbt_741_polished_silver_coffee_maker_bundle.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/11170bfe-7b75-46fb-b47e-ce18df2dd6ec/a_christmas_carol_musical_synopsis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a877234-23f4-4295-a26f-f5a07366db62/a_level_biology_cell_structure_exam_questions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50b8540a-a38f-40a2-b144-143eada03f75/95088531424.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c01a331-70dc-49af-ba9a-cbe8efe58435/6747803803.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7761710d-cb19-4485-8062-c742f7913f29/what_is_a_called_board_meeting.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/53674682-1560-4d98-a1e4-5b5b292a2db8/which_wordpress_is_best.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/effa9555-fa25-4c80-ae73-ff2f40f17985/punulilisagoluzig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ae5c8de-637f-4b3f-8389-6c3a53bd0fb3/bible_history_old_testament_map.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fdfaa3f4-2c01-4d9a-9dd4-b697628fd6a5/baritone_uke_song_chords.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e43f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE43F | 5564 bytes |
SHA-256: ef7fab2146b7afddd93473250c70a0578f2fffce2c2f8981eb96f38c2e6981db |
|||
font_01_sfnt_off0000f72a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF72A | 10992 bytes |
SHA-256: a7bc65163c18748f41a8bb5d1adce7cc866599610fd10f1660dedeaf0e2280e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.