MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=where+is+samsung+tv+audio+out PDF link annotation
- http://saxosoxajivovud.medianewsonline.com/55688197419.pdfIn PDF document text
- http://vevebopawo.mywebcommunity.org/53600918749.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417222/normal_601870fc3f6ca.pdfIn PDF document text
- https://xorowime.weebly.com/uploads/1/3/5/3/135307705/gegujipesidado-sevelakuk-dimunakeko.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427499/normal_606e90595065c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4405652/normal_6007062c4e6af.pdfIn PDF document text
- http://monubagujizud.mywebcommunity.org/18338006447.pdfIn PDF document text
- https://vogapixafaroge.weebly.com/uploads/1/3/4/2/134234717/fokamufesesisukoj.pdfIn PDF document text
- https://litazotivov.weebly.com/uploads/1/3/0/7/130740097/6461397.pdfIn PDF document text
- https://tewamuwomipatus.weebly.com/uploads/1/3/0/9/130969874/naxumala_vitufiz_guzozajasiretu.pdfIn PDF document text
- https://sivubatololux.weebly.com/uploads/1/3/4/8/134850937/a0f17c01d30b2dc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4376874/normal_5fdef594c5eb5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://jewofeket.onlinewebshop.net/buxidilivipo.pdfIn PDF document text
- http://wiloradakuno.onlinewebshop.net/ms_dos_batch_file_programming.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a30be97e-b07d-4b64-9191-6f741e2a3ec7/how_much_is_a_stihl_chainsaw_worth.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58cf7579-e553-4cb2-8321-8546dab08282/modular_sniper_data_book.pdfIn PDF document text
- http://gexegubiduw.atwebpages.com/wkhtmltopdf_avoid_page_break.pdfIn PDF document text
- http://xedawobu.atwebpages.com/packliste_backpacking_thailand.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b69c4152-8680-4de4-a28a-639144e23154/67426218283.pdfIn PDF document text
- http://vesedakowata.onlinewebshop.net/91464587224.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/feb04f94-735f-4b34-93fd-409abcb901f6/sloan_flushmate_repair_kits.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b4e9d581-e328-4395-a17e-3c68b3032b09/psychoanalytic_theory_of_freud_ppt.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a25da6ca-205f-455b-a735-4826aba6a0b2/77980795468.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db8f7bc3-4bc1-41e1-a400-d32acc8871f5/44373738371.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c44ed3d-554b-4876-b696-936c1d0bd36f/bimovelu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ecc4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xECC4 | 5280 bytes |
SHA-256: 4b63b7814dd4e2a919e29eff48f9a44b8d7e30cce10578ef92dd1bd1456b2d4c |
|||
font_01_sfnt_off0000fe9f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE9F | 10744 bytes |
SHA-256: 96b59407a9293d0bd63f747447edcd37749bcbf5b7681f8b262caee712e839bf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.