MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are SEO-optimized and point to potentially malicious content, as indicated by the PDF_SEO_LINK_FARM heuristic. One of the embedded URLs, https://botokaw.ru/123?utm_term=african+swine+fever+philippines+pdf, is directly associated with the document's apparent theme. ClamAV and ML classifiers also flagged this PDF as malicious, suggesting it is designed to deliver a phishing or malicious payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=african+swine+fever+philippines+pdf
- https://boralixaki.weebly.com/uploads/1/3/4/4/134479476/0efe169798757.pdf
- https://cdn-cms.f-static.net/uploads/4449205/normal_605e04cfd7768.pdf
- https://cdn-cms.f-static.net/uploads/4454990/normal_6035fc3083e6c.pdf
- https://cdn-cms.f-static.net/uploads/4450630/normal_60623480419f0.pdf
- https://cdn-cms.f-static.net/uploads/4473642/normal_5fd789b8c099e.pdf
- https://cdn-cms.f-static.net/uploads/4368243/normal_5fe8b9f86df8c.pdf
- https://gisafumeg.weebly.com/uploads/1/3/6/0/136098567/pesime.pdf
- https://cdn-cms.f-static.net/uploads/4366632/normal_600ad98355f5b.pdf
- https://cdn-cms.f-static.net/uploads/4365613/normal_6052b01ad839a.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/800db6d4-91fb-471f-959b-d321419d37bb/download_cheat_yugioh_forbidden_memories_2_epsxe_android.pdf
- https://uploads.strikinglycdn.com/files/56c79882-7a92-43ae-9e76-832a2e93de7f/43713729808.pdf
- https://uploads.strikinglycdn.com/files/216d347b-debe-44f7-b498-62d7cbc5ea46/triloga_martn_ojo_de_plata_gratis.pdf
- https://uploads.strikinglycdn.com/files/a338c94d-e779-4d23-915a-b415977920c2/how_to_make_canola_oil_substitute.pdf
- https://uploads.strikinglycdn.com/files/0f8a7928-2758-479e-b96c-e51968141273/bomb_explosion_sound_effect_free_download_mp3.pdf
- https://uploads.strikinglycdn.com/files/71262137-1e78-4b1d-9d6c-69521f3479ac/the_power_of_i_am_joel_osteen.pdf
- https://uploads.strikinglycdn.com/files/2e63b74f-597f-4c08-8cde-fe6dbac4bb2f/38609834905.pdf
- https://uploads.strikinglycdn.com/files/ea115385-993e-4064-9d54-13feef2b4083/how_to_become_a_medical_coder_for_free.pdf
- https://uploads.strikinglycdn.com/files/333550f5-b1b4-493b-b626-6d90783450c1/warcraft_iii_remastered_release_date.pdf
- https://uploads.strikinglycdn.com/files/205a4f37-65d0-4937-8bc2-1bceec5b635d/11313570392.pdf
- https://uploads.strikinglycdn.com/files/be180b1d-a43a-475e-995c-6a91cec1101d/rixaduvakulumam.pdf
- https://uploads.strikinglycdn.com/files/79d04304-18f2-4988-9b4d-7b92dd0d939a/99034794600.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f328.binadf58171272f69a7fec70315aba7b060b55b51fa508a21bacdc72286486c855b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF328 | 5384 bytes |
font_01_sfnt_off0001058d.bin0557673983cf90bc24780d57f0abded41055f267cab29153a2d2c53dce83576d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1058D | 10900 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.