MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many of which are likely part of a link farm designed to obscure the true destination. One critical heuristic identified a mass external PDF link farm, with a primary URL pointing to a malicious domain. The ClamAV detection and ML classifier further indicate malicious intent, likely phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=offroad+outlaws+cheats+codes PDF link annotation
- https://noxijinijomud.weebly.com/uploads/1/3/4/7/134746703/kakelonero.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444358/normal_6025531e52692.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4420448/normal_60031feb6d1c6.pdfIn PDF document text
- https://dukidisivaturan.weebly.com/uploads/1/3/5/3/135311912/4306392.pdfIn PDF document text
- https://tisizapotiw.weebly.com/uploads/1/3/0/7/130776245/gezuruzapagurir.pdfIn PDF document text
- https://namuxewanazojo.weebly.com/uploads/1/3/4/2/134266474/tanavat.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417037/normal_5fe206816d1f7.pdfIn PDF document text
- https://pesawuzopedeg.weebly.com/uploads/1/3/5/3/135327269/3e539384f09e4f.pdfIn PDF document text
- https://zuzuxaze.weebly.com/uploads/1/3/4/0/134040629/vudajojemubeve-fodifuxo-gusaxazepidazem-pebobarotelimep.pdfIn PDF document text
- https://jokiwuruxuwam.weebly.com/uploads/1/3/1/4/131437523/3805972.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476443/normal_60309edf5ef7c.pdfIn PDF document text
- https://gavokafiwafez.weebly.com/uploads/1/3/1/3/131381231/dabopebu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a5742efa-a3dc-4312-83f9-7ac2d2dfb033/how_to_winterize_a_mercury_outboard_motor.pdfIn PDF document text
- https://s3.amazonaws.com/woxorojero/customary_conversions_worksheet.pdfIn PDF document text
- https://s3.amazonaws.com/nojemi/secret_video_recorder_pro_apkpure.pdfIn PDF document text
- https://s3.amazonaws.com/liwara/netacad_midterm_exam_answers.pdfIn PDF document text
- https://s3.amazonaws.com/tujeviwakirawu/beyond_leon_bridges_piano_sheet_music.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2bc5ff5a-d150-4bfc-9723-59375a54a2a8/vishnu_sahasranama_names.pdfIn PDF document text
- https://s3.amazonaws.com/gawabog/common_urology_cpt_codes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/05b73334-1664-42d8-8afc-0a0e4708cbb4/california_leave_of_absence_chart_2020.pdfIn PDF document text
- https://s3.amazonaws.com/metakibeme/mulateur_android_pour_ipad.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ebad76b7-74a7-4689-b447-a56a48a42ef8/singer_touch_and_sew_758_reviews.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e435.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE435 | 5228 bytes |
SHA-256: d962c9747e3880f6fb92e8641719cf0404a844651164f76f68652027b6e0df5e |
|||
font_01_sfnt_off0000f60d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF60D | 11860 bytes |
SHA-256: b32220dda487264156bbcfe0db5f6fc97f3b5fa1bed91fa168064b63e28f3271 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.