MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=what+is+a+container+cloud PDF link annotation
- https://xujopikaxatanow.weebly.com/uploads/1/3/4/8/134850499/zanotinirod.pdfIn PDF document text
- https://vegilirebaj.weebly.com/uploads/1/3/1/0/131070576/4927634.pdfIn PDF document text
- https://cdn.sqhk.co/lilapanorup/Uycis31/civ_6_saladin_madrasa.pdfIn PDF document text
- https://cdn.sqhk.co/letareximo/hicVnsm/kebofisalepotokawirapow.pdfIn PDF document text
- https://cdn.sqhk.co/rufopunuk/ghaSWHQ/harry_potter_hogwarts_mystery_clubs_day.pdfIn PDF document text
- https://mosezusimoz.weebly.com/uploads/1/3/1/6/131637881/bedox.pdfIn PDF document text
- http://jesibijifinuz.mywebcommunity.org/24618527530.pdfIn PDF document text
- https://cdn.sqhk.co/lekavuwapefi/pgNhfbf/lavifafupamir.pdfIn PDF document text
- https://lanapovo.weebly.com/uploads/1/3/1/4/131437145/garifijudaxoj_kodezalanaza_gixesi.pdfIn PDF document text
- http://pukutabutosu.22web.org/luvunanedubabelulaj.pdfIn PDF document text
- http://zozitaze.mypressonline.com/mupot.pdfIn PDF document text
- https://wexasubofuxumeb.weebly.com/uploads/1/3/2/7/132740188/db2ebcf959.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/0c8beb59-2ea2-4332-b542-0c3b38a54d12/one_thing_remains_jesus_culture_guitar_chords.pdfIn PDF document text
- http://bibekuxamawijoz.epizy.com/spanish_gerund_worksheet.pdfIn PDF document text
- http://xovufavon.rf.gd/posofadole.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/090734be-3173-4085-ba77-02342aa950cf/graco_lauren_crib_with_changing_table_instructions.pdfIn PDF document text
- https://cdd249b8-77b1-4a94-b024-8995efe4d959.filesusr.com/ugd/d394ff_4f35e8cd457240b49e74b4e3e2038af2.pdf?index=trueIn PDF document text
- https://a52dd608-e7dd-4d50-8005-e0fd7a3896b4.filesusr.com/ugd/43d2fc_df6e0ef6d2114e74b5be201be9a17f23.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/40292dc3-19d2-4679-ac47-f47c7dc29edc/the_count_of_monte_cristo_abridged_by_lowell_bair.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2edaefd-6585-4f11-a34c-d1f2c0d58d06/gokuxujivik.pdfIn PDF document text
- https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_17f727c4b98e4775918cd3be399d732a.pdf?index=trueIn PDF document text
- https://ed4d48c2-14ea-47f5-a89a-b82193587323.filesusr.com/ugd/8ce377_3427e4edcf944852829b9700203f2d20.pdf?index=trueIn PDF document text
- https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_c99405721c19490babd85eb6378e95a2.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001026f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1026F | 4924 bytes |
SHA-256: 5d4335d0888dca6715d5ce168d548ec6079cae5c3b48bac1ce7829457ca5e3ed |
|||
font_01_sfnt_off0001131a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1131A | 11024 bytes |
SHA-256: c926432413c8837fe51a3b9f7b4fc8e488c8e585baa6148c43e58d223e4adcc7 |
|||
font_02_sfnt_off000138de.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x138DE | 4324 bytes |
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.