MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/123?utm_term=adobe+acrobat+reader+for+pc++free PDF link annotation
- http://lulemaxig.iblogger.org/53785205491.pdfIn PDF document text
- http://fadekitexef.iblogger.org/fefovejipipezusogopumo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411701/normal_60190b9ba4ad5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414169/normal_6019a2b7afad7.pdfIn PDF document text
- http://am-sound.ru/89432282857b6kjr.pdfIn PDF document text
- http://mamontov-net.cc/327709313070b83o.pdfIn PDF document text
- http://cozyplacefor.rest/miraculous_ladybug_wiki_episode_guide9rzrb.pdfIn PDF document text
- http://gatorama.site/wajukefukizuraxobulejaog7df.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tixedujegibex/beginners_guide_to_fantasy_football_espn.pdfIn PDF document text
- https://s3.amazonaws.com/rubidokezive/4k_wallpaper_for_iphone_x.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91d7a3cf-2cdb-4bd2-b613-cfda1a0c832e/44193633473.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bdc027ef-781e-47a3-8e43-0b1d66f9195c/orbit_model_57894_wiring.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/33e21494-6bb8-465f-951b-ea2c5c8d5192/the_chaser_movie_online_with_english_subtitles.pdfIn PDF document text
- https://s3.amazonaws.com/rizijubovapuk/29327606074.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/796d5b8a-126f-4a50-8739-92ac98672c44/luletebawofax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6811ca10-812b-42e5-be62-248c94176c72/89245793049.pdfIn PDF document text
- https://s3.amazonaws.com/povodijirig/fugiviwigoferixapatifu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1ba4b717-ade9-4670-877a-5bd333b44e38/92521461940.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4bc1b1e-d495-4e09-91f3-b15f6f659457/60599279329.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f209334e-40e3-4c34-b632-f973676f40eb/escape_from_mr_lemoncellos_library_full_movie_online_free.pdfIn PDF document text
- https://s3.amazonaws.com/tobojelusiwi/coshh_risk_assessment_template_uk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5640472b-51b1-4745-9adf-6ac28d012954/book_of_spells_journal.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010176.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10176 | 5068 bytes |
SHA-256: 7fd8e155c7bdb3f7508a6a772ae20d1cb072a61ce7fe029901ee82d286f27108 |
|||
font_01_sfnt_off000112c2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112C2 | 10528 bytes |
SHA-256: 7a684cb6f7622eeeabab5f3fe48bf1281eb14160035cbc6ce79e9c79adebdadd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.