MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=me+and+bobby+mcgee+ukulele+chords+pdf PDF link annotation
- http://bonboxstudio.com/indian_history_books_for_competitive_exams4ktou.pdfIn PDF document text
- http://varietystore.website/somonasijuwofusuzimudvrahp.pdfIn PDF document text
- http://esmoney.site/jobafupojurpktjo.pdfIn PDF document text
- https://cdn.sqhk.co/wufevinek/Ci1jiZf/ski_jump_nose_shape.pdfIn PDF document text
- https://cdn.sqhk.co/xafogatok/WGfihha/waxajote.pdfIn PDF document text
- https://cdn.sqhk.co/wokowuvawuz/gjdijig/jobezujive.pdfIn PDF document text
- http://moneymaya.site/annihilation_book_ending_explaineds2new.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://203e60c5-e32a-4587-ab6d-31d66de6d5b9.filesusr.com/ugd/014c36_c16993670aeb495abef84253abcd3f69.pdf?index=trueIn PDF document text
- https://2863666b-9d79-467d-9aad-9eeb6dafbdf2.filesusr.com/ugd/6ee3eb_8862170d2ea14c8f8fabdf74a578b34a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dapekufoxiraku/billboard_latin_music_awards_2019_performances.pdfIn PDF document text
- https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_ef22c2903fa04e9bb28cab70e5064772.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jowutoneranemuk/answer_me_please_translate.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/215a2bb5-b563-42ea-926a-f20369f97b5a/kizatugigatofebe.pdfIn PDF document text
- https://6ce95562-7558-49ee-a7b0-b3003db3b0e9.filesusr.com/ugd/d13e1f_bc74620ffcba4b3e8e398e666a8db9c0.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/34b092f4-fe0a-41bf-9d27-02990a81341b/resumen_por_capitulos_el_amor_en_tiempos_del_colera.pdfIn PDF document text
- https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_b5b059d97a9f4cc1b2ff94158e333a41.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3c3ee6d3-7225-408e-8893-f4aa1a8e19b0/2006_honda_civic_front_bumper_lip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de48dd91-5197-4d6b-8ac8-c53205cbb686/difference_between_the_fault_in_our_stars_book_and_movie.pdfIn PDF document text
- https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_2c6d25c42e4640a0afdfa187cf7e27d1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/liwara/81157994419.pdfIn PDF document text
- https://71a5d838-4e22-4830-8da1-7955ec3365f5.filesusr.com/ugd/f2f43e_7602e59d680a4386b23db46e17beb636.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/pisik/jubuwufibes.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7cc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7CC | 5880 bytes |
SHA-256: 79177b1418e8b75d94b331afead035fba22400a2fccd749bd193da18187bde2a |
|||
font_01_sfnt_off0000fbb9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBB9 | 11868 bytes |
SHA-256: 01de55964e2b085f39c8ce9943084360657e6ecc1e95c87b9a7224aaa2b6f4c1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.