MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=cleaning+service+business+proposal+template PDF link annotation
- http://zawubitukete.22web.org/how_to_replace_drum_cartridge_xerox_3215.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/f888c100-cff0-484b-9f94-14677e2d51af/pride_and_prejudice_movie_live_stream.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9895ea68-3b57-42b9-a69b-34cec903adbf/64980223764.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc3acba3-f902-4aa9-9c85-0f88fa73e200/jonisipananamus.pdfIn PDF document text
- https://a49aa754-465e-4bbd-924e-b3d0e7b66bd4.filesusr.com/ugd/81d6a4_3fd28cc825e94665889e6287a6138d0b.pdf?index=trueIn PDF document text
- http://tananij.rf.gd/hoover_floormate_spinscrub_500_owners_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5f24b8d-5893-4b22-8147-54adbadd6ff3/57884614186.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/09664470-5868-4832-9d25-63941aa6a19a/2007_jeep_grand_cherokee_limited_hemi_problems.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e7916b2-4cbc-45f2-b298-49ea72c1b363/mikakodub.pdfIn PDF document text
- http://suvubojetixag.epizy.com/german_national_anthem_sheet_music_piano.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f455c48-13c1-48fd-8fbc-04ee55e5ea6b/60762380462.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db2f8593-3c1d-464b-8c05-9d4f472eafe5/caracteristicas_de_la_forma_de_gobierno_republica_federal.pdfIn PDF document text
- https://247e77cc-5367-4382-8586-7c5891409f42.filesusr.com/ugd/2dbf5a_f937b0357d06455d9683a4f5336b11df.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/af1ab9e9-b824-44b8-9109-876b2563662a/46730438475.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ae6ec0c7-ab77-4bc4-adf4-a14ed841e98b/1286212358.pdfIn PDF document text
- https://6d4cd3b7-91e9-43ac-92b9-205473f1e50d.filesusr.com/ugd/28146e_f6374a771c9246fdbebf0cdff5a8289c.pdf?index=trueIn PDF document text
- https://8ab8d0a6-ebcf-4503-ac90-3c5d9a0926ce.filesusr.com/ugd/8585d4_036344b0dbb841fe930f8b229ffd6ab8.pdf?index=trueIn PDF document text
- https://7a3463bf-3117-47cc-940f-ad9d50d05675.filesusr.com/ugd/9f2514_bfaa1a7cf5b7447f940c49480d4c6e8f.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c3a4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC3A4 | 5356 bytes |
SHA-256: 5064704986807ee282d3d3c721701048e922ce5e7985fe1fc03f244da53b50e8 |
|||
font_01_sfnt_off0000d5cc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD5CC | 9800 bytes |
SHA-256: 1f9fdb327aacf5ff1c06053345f3607767d025a932de36b6a5f5f5d59ed22cf9 |
|||
font_02_sfnt_off0000f706.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF706 | 4324 bytes |
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.