MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by both ClamAV and an ML classifier. It contains a large number of external links, many of which point to disposable hosting and use UTM parameters, indicating a link farm designed to redirect users. One prominent URL, 'https://baarspo.ru/123?utm_term=financial+calculator+app+free', suggests a lure related to financial applications. The document body is heavily obfuscated, but the presence of external links and the overall structure strongly suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/123?utm_term=financial+calculator+app+free PDF link annotation
- https://cdn.sqhk.co/bataseset/fGjeDFZ/33470380027.pdfIn PDF document text
- http://kibixus.iblogger.org/babasaheb_ambedkar_in_marathi.pdfIn PDF document text
- https://cdn.sqhk.co/pemofirojez/sfgc4zH/ropolore.pdfIn PDF document text
- https://cdn.sqhk.co/nosimasiv/AaJS8hd/aarp_travel_road_trip_planner.pdfIn PDF document text
- http://rolivazugatar.scienceontheweb.net/espresso_english_grammar_level_4_free_download.pdfIn PDF document text
- https://cdn.sqhk.co/mudemodox/dlQ91hd/28040615124.pdfIn PDF document text
- http://rosativiwam.mypressonline.com/clinical_research_associate_interview_questions_and_answers.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/bbf3736d-f2a1-447b-b14f-1d9b38b701b9/python_class_example_code_github.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/433cbf85-6f2d-4f79-a60d-48b4fbcd911c/milujowepavegorugirav.pdfIn PDF document text
- https://c5b3e1fc-3b55-407d-a8d9-2bfa6c9015c1.filesusr.com/ugd/6df244_35a6a51388bf45f1a12256051f783736.pdf?index=trueIn PDF document text
- https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_9586528f9b4846cd8735a954c01866ce.pdf?index=trueIn PDF document text
- http://kubemumibesedu.epizy.com/92141501779.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2417302a-093c-41de-8eaa-2a7271c46df6/1996_polaris_sportsman_400_carburetor_adjustment.pdfIn PDF document text
- https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_603efed98291457c86b28bffbba09379.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8e65877f-d94f-4146-b22e-4ad308e6d117/how_many_calories_in_dunkin_donuts_pumpkin_spice_coffee.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c4060a9-2f34-4203-89e6-dd7f339d5391/tozer_pursuit_of_god_study_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36fe1926-7324-49dc-8ef4-0c285ba03c38/is_taco_bell_nacho_cheese_keto.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d12f1c1a-1285-4c29-8e1c-48f82e0343e7/ronunesejaxe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71a44c38-5958-4af6-aa02-b0b4ad98e6e9/harry_potter_books_1-7_boxed_set.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fdc8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDC8 | 4788 bytes |
SHA-256: e037fae4dbc33eaaaa64186cad2264dd69146d01ff4118fc2ac640b34d2a5d5a |
|||
font_01_sfnt_off00010e23.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E23 | 11068 bytes |
SHA-256: 3628bdc3d11b53134f1f1e5eac8035fb471321d438286aebb39b34bc6e05a17a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.