MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=engineers+black+book+pdf+free+download PDF link annotation
- https://static.s123-cdn-static.com/uploads/4472768/normal_5fcb4bf19606c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4500679/normal_604e1955ccba4.pdfIn PDF document text
- https://mitigovoponezix.weebly.com/uploads/1/3/4/3/134375948/933bcc74310.pdfIn PDF document text
- https://dolojimopa.weebly.com/uploads/1/3/4/8/134887070/7617327.pdfIn PDF document text
- https://bavopasivivewid.weebly.com/uploads/1/3/0/7/130738836/cf51330c5.pdfIn PDF document text
- https://wefopizek.weebly.com/uploads/1/3/4/8/134849363/746819b4c6b62.pdfIn PDF document text
- https://pavedivagew.weebly.com/uploads/1/3/4/4/134468388/foduvuvon.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481291/normal_604aa1681691a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sowewazulejewi/lekusoxid.pdfIn PDF document text
- https://s3.amazonaws.com/fedure/apc_smart_ups_450_battery_replacement_instructions.pdfIn PDF document text
- https://4b523d79-2bc6-404f-8e52-0acae4d2cb03.filesusr.com/ugd/fe1b41_f6b52dc77d5345bd8052e21c0b0a4dc4.pdf?index=trueIn PDF document text
- https://1ffb5d6c-d890-49e0-9b87-dc10fbfa49e2.filesusr.com/ugd/8bc2a6_928c90bc95ce4e128da582a819eaed92.pdf?index=trueIn PDF document text
- https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_7dd7e12f7bd34750b38113b569a54195.pdf?index=trueIn PDF document text
- https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_56b8c0aea6ab4a4fa8daf86280ea1332.pdf?index=trueIn PDF document text
- https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_26d32cf0447b4ff88fc5596aee79f395.pdf?index=trueIn PDF document text
- https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_8d3bc571a556496987be45e89feef0dc.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jupudizadid/apothecary_system_conversion_worksheets.pdfIn PDF document text
- https://a146b927-ed54-472d-b3a8-6b137e313b92.filesusr.com/ugd/4d400c_dd0a16ac8d214e629a0eaf5a26c38055.pdf?index=trueIn PDF document text
- https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_0ee787ba8ced4d38904b4dde41f440cf.pdf?index=trueIn PDF document text
- https://ac4cd5cf-e861-4b1b-a585-e47049f737a6.filesusr.com/ugd/843280_a2c9921929ee4b6c98b327461877a1bb.pdf?index=trueIn PDF document text
- https://a22c3535-4c29-4f26-bf6b-1e631d3648e5.filesusr.com/ugd/28986c_8070b0c28c72400db928c1e98b57f504.pdf?index=trueIn PDF document text
- https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_7974d09b60d04048abd32b7d7e97db00.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010944.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10944 | 5576 bytes |
SHA-256: bbdc3d4c5fb76c55ab6b89ab5b511b093a80d386247119fe57d2428be4ef8961 |
|||
font_01_sfnt_off00011c63.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11C63 | 12144 bytes |
SHA-256: 6597ec1ffa849bfe6833109440201354636d93aa3ecf340c8f12323eb68d2468 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.