MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=estaci%25C3%25B3n+meteorol%25C3%25B3gica+davis+vantage+vue+manual+espa%25C3%25B1ol PDF link annotation
- http://begemot.space/peppa_pig_toys7uawr.pdfIn PDF document text
- http://mavpa.fun/kokexivavenuzimeriyjf2x.pdfIn PDF document text
- http://parralax.net/pofitunewror4q.pdfIn PDF document text
- http://kinoxca.xyz/bigger_leaner_stronger_nutrition7e7h8.pdfIn PDF document text
- http://electorat.org/tavepuwamutogexubaby9hsz.pdfIn PDF document text
- http://bottlechainworld.com/20137590164vkhck.pdfIn PDF document text
- http://jopkapopka.online/felowufelugofokogopibu1762r.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f1e2868f-0c6b-4eda-9bf1-83949e11df2a/do_wendys_spicy_nuggets_have_egg.pdfIn PDF document text
- https://s3.amazonaws.com/tujeviwakirawu/health_canada_analytical_method_validation_guidelines.pdfIn PDF document text
- https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_3f9aad89981f47a4b73a1ab32dcccac8.pdf?index=trueIn PDF document text
- https://46ebecaa-9490-439b-bba6-ee77f1a6ca93.filesusr.com/ugd/cee8a1_13c4cfe5fc6e48c68136f38159aae795.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f409b690-c1fe-4312-bc28-872cce1c8852/how_to_use_wagner_wallpaper_steamer.pdfIn PDF document text
- https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_4026f53cc2bd494aa6a5d08704d6b3de.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/luxaduzimase/eclipse_stephenie_meyer_quotes.pdfIn PDF document text
- https://s3.amazonaws.com/fujadabez/3d_contour_mapping_software_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b30ffa6-ee18-4247-8afb-6b9768864c3c/dark_souls_2_4k_mod.pdfIn PDF document text
- https://9cf5cc10-3c2e-4e30-ae6b-73ed7beed88a.filesusr.com/ugd/5c2b46_d3e107332a0a42a3bc80a9977d026c27.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xuzed/guidelines_in_making_identification_type_of_test.pdfIn PDF document text
- https://s3.amazonaws.com/kujapomib/41821127477.pdfIn PDF document text
- https://s3.amazonaws.com/xurixado/thimiru_pudichavan_full_movie_tamilrockers_tamil.pdfIn PDF document text
- https://s3.amazonaws.com/legobegutulo/xomejelupoviwu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/67565808-4821-49dd-a3cb-c3403fb34734/58785647361.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010819.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10819 | 5760 bytes |
SHA-256: 1b97bca47fd790a154a2beaa4a65248ac70fcfb8305d5f95f06583eb4679b940 |
|||
font_01_sfnt_off00011b24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B24 | 13048 bytes |
SHA-256: 50fd50426e40c9fa4fe942c1186d07aa9fe784b62939e80817b3c82855558ede |
|||
font_02_sfnt_off000145b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x145B9 | 16260 bytes |
SHA-256: efcda8d0ea25d013786d5cbe7517ed73f55ce1dfb17c74525e0554ea8b1a3d3d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.