MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, a common tactic for phishing or SEO spam. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of links, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. The embedded URL 'https://maypoin.ru/wix?keyword=properties+of+matter+worksheet+8th+grade' is particularly suspicious and likely leads to a phishing or malware distribution page. No scripts were extracted, but the overall structure and link farm point to a malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=properties+of+matter+worksheet+8th+grade
- http://bejuzoz.iblogger.org/billy_carson_emerald_tablets.pdf
- https://givadebar.weebly.com/uploads/1/3/1/4/131437750/vatem.pdf
- https://porujeworor.weebly.com/uploads/1/3/2/8/132814718/sofubapifoxuma_dimawofenosela_ridopewotadow.pdf
- https://cdn.sqhk.co/gopuxipo/hdIC0ic/greatest_hits_of_the_80s_rock.pdf
- https://cdn.sqhk.co/pibilebomek/tjhfEhc/slingshot_shooter_drink.pdf
- https://cdn.sqhk.co/fepebage/7igZher/65838739544.pdf
- https://selemuja.weebly.com/uploads/1/3/4/8/134893326/sasibegusaw.pdf
- http://niwagiw.22web.org/79501858535.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/ddaff43d-ac54-45ac-87b4-f04b1d8415d4/how_to_win_the_booker_prize.pdf
- https://uploads.strikinglycdn.com/files/9d7a326e-0d51-4205-a083-11136be40333/adobe_illustrator_classroom_in_a_book_2020_lesson_files_download.pdf
- https://6c71f620-b6e5-46cc-9e58-526c5f0a7a41.filesusr.com/ugd/1c90dc_2a657709113b4e3eb68052a0a6bc234e.pdf?index=true
- https://66f9c2bc-82a6-463d-9ccd-9c94d3d8805e.filesusr.com/ugd/b361c6_98f1b7bd7e2e4745a9dbe27ed965abaa.pdf?index=true
- https://uploads.strikinglycdn.com/files/085a6a68-2cca-4051-92b8-0f9c28b161d9/kill_team_starter_set_2016.pdf
- https://e114ad41-1367-46fe-a5fd-427bf640f69d.filesusr.com/ugd/a63c55_1c9ef4b13f53455ab606677b628ff553.pdf?index=true
- https://ab737b70-891a-4a1f-8db9-ee548211cb31.filesusr.com/ugd/ce14f3_f494c2ea0d094c088a35c99b8cb01ec2.pdf?index=true
- https://uploads.strikinglycdn.com/files/700a376e-dbf8-4788-a3f3-840ac2f23a17/vifafunufibexara.pdf
- https://uploads.strikinglycdn.com/files/83bd7502-cd8a-4b06-b951-b1fd66041275/jazigul.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000db13.bin2d15ed3e7033f89f2c2162c1195a82d45e748cdb3002c60ae4fe1934a0502586 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB13 | 5456 bytes |
font_01_sfnt_off0000edb2.binbac347eec51a7c2eda983dc41fdb2f6e08dcdb6d49b9f78717a9a04908f916bc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDB2 | 11148 bytes |
font_02_sfnt_off000112c1.bin9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112C1 | 4324 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.