MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/strik?utm_term=the+watsons+go+to+birmingham+read+aloud+chapter+7 PDF link annotation
- http://bakavorun.getenjoyment.net/the_adventure_zone_graphic_novel_free.pdfIn PDF document text
- http://siwivelijutore.medianewsonline.com/news_report_template.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://9a1eab6f-da2d-4a41-99bb-18a59f11b130.filesusr.com/ugd/c2b690_66ac5b6d4c5b409da45b387a0dc4174a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cd6ce9f0-c6ff-4a90-af5b-2de347323d48/25784764412.pdfIn PDF document text
- https://b23183eb-b2e5-455e-bc25-91fac1efd10f.filesusr.com/ugd/cc14e4_6ea71510c2df4d9f876affdf0ed154e0.pdf?index=trueIn PDF document text
- https://9f5bcc56-a059-4f00-ae85-604acd6a3d2d.filesusr.com/ugd/ac9354_094e2f59d20641a6928dfc98cef9286f.pdf?index=trueIn PDF document text
- https://4123e755-5e7e-4fb8-b167-49ba90d37259.filesusr.com/ugd/fd3290_7ac09d1bdb87491b8991f113736e9605.pdf?index=trueIn PDF document text
- https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_39bce715caee4384bfc70dd10608dec7.pdf?index=trueIn PDF document text
- https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_46728a9316dd4b9c904ed17256447c35.pdf?index=trueIn PDF document text
- https://9a4b5e96-23fe-4021-9525-787506808755.filesusr.com/ugd/b3318b_efb838184cb24c3c918d91a10483d7a3.pdf?index=trueIn PDF document text
- https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_4ef4f7c5f3414ec3ac7859ca76e60f60.pdf?index=trueIn PDF document text
- https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_0fbe55b99eef441b8fe9bf164e63d88e.pdf?index=trueIn PDF document text
- https://a134ef9b-a212-4d8e-a35f-da3d896bbd40.filesusr.com/ugd/dadc92_aad85895574b4d7985f8c5cbc3317d96.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fe4ecf0f-1bbf-4ed2-912c-08b245c68d06/64362217188.pdfIn PDF document text
- https://cd65756b-a9c7-4cca-9498-1747a6459195.filesusr.com/ugd/05eb20_a65dcadde21a4010b4eb303a125f4b02.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00015a2c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15A2C | 5632 bytes |
SHA-256: 01cee664334408b0fae79f044f54f21fe8c3b4034db351c6b9f846f02218e33f |
|||
font_01_sfnt_off00016d36.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16D36 | 11252 bytes |
SHA-256: 5f74e0d2c0a92d9ca0f0384ec64250abbcbb82766c0d52a2cb3785c75649c061 |
|||
font_02_sfnt_off00019365.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x19365 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.