MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classification and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing campaign. The document body, though truncated, includes a title related to a 'fortnite cheat sheet' and references 'wkhtmltopdf', indicating it's likely a lure to drive traffic to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/123?utm_term=dockyard+deal+fortnite+cheat+sheet PDF link annotation
- http://rofogukiluvupu.mygamesonline.org/daily_tamil_news_paper_download.pdfIn PDF document text
- http://ruguwafe.scienceontheweb.net/50951120367.pdfIn PDF document text
- https://cdn.sqhk.co/xufatirumina/ibibpqL/fajutujabapimupumeladama.pdfIn PDF document text
- https://kanamatadu.weebly.com/uploads/1/3/4/3/134366206/vekanolero_kizolivanizi_fapokuju.pdfIn PDF document text
- https://duketexu.weebly.com/uploads/1/3/4/7/134725944/duzewoxikawodujunur.pdfIn PDF document text
- https://zotorakiv.weebly.com/uploads/1/3/0/7/130739478/xibizefu-savesufevupok.pdfIn PDF document text
- https://cdn.sqhk.co/posaleren/cBRVlP0/movistar_el_salvador_servicio_al_cliente.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://sojufuka.atwebpages.com/what_is_a_concurring_opinion_in_the_supreme_court.pdfIn PDF document text
- http://wutejaxevewef.myartsonline.com/6599114421.pdfIn PDF document text
- https://05491ccc-77c7-428b-9c25-74f2c6c50d4a.filesusr.com/ugd/d51d36_fd3a385d286e40ed93cf41b86b5a8ea1.pdf?index=trueIn PDF document text
- https://fc060a1e-8c1d-4b7d-bafd-75f79d4c6355.filesusr.com/ugd/c0a468_70d7ef0f277c41bdbdc507185831ceb1.pdf?index=trueIn PDF document text
- https://eb72eaa1-ef55-40a3-a653-f6d21bccf295.filesusr.com/ugd/54913d_c355d40d0f1a4efca21fa0e9bb63d7a1.pdf?index=trueIn PDF document text
- https://3b87a2b8-2d13-4e6d-acc4-cbba57692a59.filesusr.com/ugd/50988c_5defd0cc39ce4973891b77bb20f83088.pdf?index=trueIn PDF document text
- https://8d67285a-e3c5-4820-bb1a-bb91ce1079a6.filesusr.com/ugd/d54300_1c39cf661ef74f4fb5b99a7bf635392d.pdf?index=trueIn PDF document text
- https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_cad556f771f948cab6ddc7ace9c768c6.pdf?index=trueIn PDF document text
- https://964beff5-d24f-450a-94e2-fa7e9faef44a.filesusr.com/ugd/61158f_37732ca7caac416eb85132ebd1f93db1.pdf?index=trueIn PDF document text
- https://8eeb1f0a-0cdd-4c66-98a4-83777b49fb54.filesusr.com/ugd/64f9d2_074a9fad9db148dbb28be04cbe6389a0.pdf?index=trueIn PDF document text
- https://76ed6b59-b034-43ac-b949-e1c08f76e3cb.filesusr.com/ugd/ee6100_2800f45397aa436b8ed39b7a7a315401.pdf?index=trueIn PDF document text
- https://cb6d8354-940b-4e05-9f1d-0150973ab277.filesusr.com/ugd/882da0_449a835c9f5345b5904f21216b2ba6b8.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f435.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF435 | 5276 bytes |
SHA-256: 2f39f30870ee9f449950339e696bd3b74536fb2b59b02a2d5fcc5cc06ba634af |
|||
font_01_sfnt_off00010630.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10630 | 10488 bytes |
SHA-256: 6ee43fd3c9a1c21a8e448fb8b17e8d006569838e51ec8ee22e62d8c56a232dd0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.