MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=crossbow+plans+free PDF link annotation
- https://cdn-cms.f-static.net/uploads/4468270/normal_6032a15bebf84.pdfIn PDF document text
- https://cdn.sqhk.co/kinanunir/njia0hh/guwanirebigawurixip.pdfIn PDF document text
- https://cdn.sqhk.co/levowexesu/ifhfzhg/vawopuweroverupitotil.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4472766/normal_5feca061a8301.pdfIn PDF document text
- http://counterman.ru/monat_compensation_plan_cadillacuvv8x.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489035/normal_60394cb71b286.pdfIn PDF document text
- https://cdn.sqhk.co/vasegodesazu/8mge3Ln/love_nikki-_dress_up_queen_mod_apk_download.pdfIn PDF document text
- https://cdn.sqhk.co/riragimi/chdiiie/88004310259.pdfIn PDF document text
- http://biomaniix.website/minn_kota_powerdrive_i_pilot_kitubqqe.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/487f51b4-09fb-4da0-b843-2abbfe16adc6/graco_duet_connect_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7ac44480-4e19-4c44-a9d0-aad27d3b2b5a/dofuradofi.pdfIn PDF document text
- https://e7ba4f66-d023-404d-a355-a5b98970f127.filesusr.com/ugd/cac9e4_7bdc57ba85dc4af882cd4675813853f3.pdf?index=trueIn PDF document text
- https://3dbd840c-7861-42b4-b064-af52d1d2f4eb.filesusr.com/ugd/86319b_ea5890c861054157b46799ee56ffa01d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3940b5c4-790f-4387-b7ab-326380f24e75/53777476993.pdfIn PDF document text
- https://5da1c7d8-01c4-4175-bbf8-c25915566394.filesusr.com/ugd/1084fb_5dccb6e8582a426d93373b4278eb2d2a.pdf?index=trueIn PDF document text
- https://620678a0-8f5b-407b-881a-8a96a128c1c4.filesusr.com/ugd/25b7a6_3761c52d5d8543949c276852b1278e9a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/df056ee5-ec51-4a14-b2fa-6cfb7dac3d83/is_my_cdl_valid_without_a_medical_card.pdfIn PDF document text
- https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_107317f508944540a8199ee800f4bbd1.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b4f56831-7cb3-43c2-9506-e4febde924f9/big_bang_theory_ks2_lesson.pdfIn PDF document text
- https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_cca81249e1d0493aba63995d1d8c8934.pdf?index=trueIn PDF document text
- https://c580675e-8888-491d-8c80-3106eaac86fb.filesusr.com/ugd/c8a981_c39b72d50b724ee4b89609c94bd0bca7.pdf?index=trueIn PDF document text
- https://1416a32c-f91c-4ec3-9c10-bfdf610c7df7.filesusr.com/ugd/76de1a_7a6e5ff2fc27456e96f84d23e732eb87.pdf?index=trueIn PDF document text
- https://989eff4c-946f-4221-9817-1a8d60f2082d.filesusr.com/ugd/7edf14_d89ffe1e94d547839ab97043fed89ca4.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011db6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11DB6 | 5032 bytes |
SHA-256: e8a9e9bbc6d841fcfd468968933ed0f68589a67041d048d40903169705e64d14 |
|||
font_01_sfnt_off00012eed.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12EED | 11196 bytes |
SHA-256: 1a3d231adcd9ce75b64f89c8eebb5e85d7da6ffb00430606fbeaabe0a52b1e8e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.