MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/wix?keyword=mrs.+taylor%2527s+classroom PDF link annotation
- https://cdn.sqhk.co/ranetixeba/jDijjar/80167789757.pdfIn PDF document text
- https://cdn.sqhk.co/duwenaxiseve/ididlPf/slack_download_folder_linux.pdfIn PDF document text
- https://cdn.sqhk.co/vefomatakin/ieji6ja/pofawagilutavipem.pdfIn PDF document text
- https://cdn.sqhk.co/poxirowo/JhaLjfa/spirit_animals_goodreads.pdfIn PDF document text
- https://cdn.sqhk.co/rekutadis/idgdihi/stepside_truck_bed_toolbox.pdfIn PDF document text
- http://tizadejaso.getenjoyment.net/bank_loan_application_letter.pdfIn PDF document text
- http://3-bureaureport.info/xexamaxelolmqqj.pdfIn PDF document text
- http://limaxinsto.xyz/how_to_connect_my_canon_printer_to_my_pcnrugp.pdfIn PDF document text
- https://cdn.sqhk.co/vemudumuxixu/jhmibFo/zowivejij.pdfIn PDF document text
- http://lotukaguw.sportsontheweb.net/bin_sachivalay_clerk_computer_book.pdfIn PDF document text
- https://cdn.sqhk.co/futogifoku/GhdhNiW/vitalsource_bookshelf_reviews.pdfIn PDF document text
- http://begemotiks.fun/tagadikbor80.pdfIn PDF document text
- https://cdn.sqhk.co/zixapegof/djgchhg/create_device_manager_shortcut_windows_10.pdfIn PDF document text
- http://pivojowemetobiv.mywebcommunity.org/76139030104.pdfIn PDF document text
- http://instapodarok365.site/dezujikebizejofofevumwzc7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/610d208e-e6ed-4ebd-8b7d-0a6bdf7d84f8/tipos_de_comunicaciones_militares.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f948dbe8-1a33-47b3-b2e7-d1b3dcacc63e/41856159947.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e1e76b7-03cd-4bb0-8e70-3d039ca67e33/is_sense_and_sensibility_a_romance.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b0aac27-b187-41a7-bbbb-19b5b7937dd1/63532251734.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b2616d2-de12-4b78-b4bb-0af54ca969e3/tabla_peridica_de_los_elementos_en_fisica_definicion.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1bdaf114-2315-40e1-bc3e-697b2756ab65/47609667501.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bdfb5bb6-8755-4628-9fa4-0c10b7f550fe/how_to_setup_elgato_game_capture_hd60_s.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7264dfc3-3a5d-4b90-98a8-e5df1b3e665d/guess_the_food_game_ideas.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f26f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF26F | 4636 bytes |
SHA-256: 6a8500d0955fc57b3fae609adaed18ccc236317df5dfcd9f08de7ac02500884c |
|||
font_01_sfnt_off0001023c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1023C | 11692 bytes |
SHA-256: 35037ff7f9969373d9ec7ac8c9903ea2b4170cc3a4bebca82106706dc23e785e |
|||
font_02_sfnt_off000129b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x129B9 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.