MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/strik?utm_term=how+to+set+up+hotspot+on+iphone+8+at+to+your PDF link annotation
- https://jasunibimagimuf.weebly.com/uploads/1/3/4/7/134733129/4579656.pdfIn PDF document text
- https://wawukonuxoni.weebly.com/uploads/1/3/4/0/134095992/1525199.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4484355/normal_5fc72a94ce512.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388596/normal_6035af682f88b.pdfIn PDF document text
- https://xopaluwejur.weebly.com/uploads/1/3/1/8/131857284/lepofuved-bekefapuputab.pdfIn PDF document text
- https://tizirabavapamob.weebly.com/uploads/1/3/1/4/131453045/laviginojomini.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459466/normal_6027e957da999.pdfIn PDF document text
- https://bilujujopubeda.weebly.com/uploads/1/3/4/6/134661541/dcb99bcea0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413227/normal_603184f6dfcd2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393779/normal_606b5ba78e1c5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365642/normal_600fe4db73b89.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374189/normal_604a32c26ccfe.pdfIn PDF document text
- https://guxewegitonis.weebly.com/uploads/1/3/4/3/134336720/bezajofoperuf-xanuzireko-buvutivetuti-fanovemon.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489601/normal_606929b0853fe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450634/normal_6028f5a2b8f35.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405895/normal_60285ef04b21a.pdfIn PDF document text
- https://jixejuterekafiw.weebly.com/uploads/1/3/4/5/134508928/mofaka.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408004/normal_602d5e7734c21.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4486765/normal_60b2f26329f66.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468572/normal_603740c0c33d0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/07e7840e-27e8-43bb-bbe9-f726eff63139/how_do_i_set_time_on_sony_dream_machine_clock_radio_icf_c218.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb1bff28-7b96-496a-9455-c5a12e33c13c/boputidafixaw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5fc502d2-56ef-4708-b1a3-9a69182e663d/jedikivoxeke.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f016a024-05b9-4191-ba24-17fadbd9988f/naming_binary_molecular_compounds_worksheet_3_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e813b8a4-8f89-44e6-9425-c1fc93e247d9/57946518931.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee1a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE1A | 5224 bytes |
SHA-256: cdf68675859dbc2881e54fe4607649068d29da7c0d1cc459c2ff06892fe46abc |
|||
font_01_sfnt_off0000fff3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFF3 | 11840 bytes |
SHA-256: 73c2ec59969f4aca2fb0647f8acedb35a2f3230c3d8bae2175affc686c1f636f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.