MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or phishing operation. The primary suspicious URL identified is https://ketchas.ru/pbw?utm_term=fundamentals+of+geometric+dimensioning+and+tolerancing+pdf, which is likely part of a campaign to drive traffic or phish users.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ketchas.ru/pbw?utm_term=fundamentals+of+geometric+dimensioning+and+tolerancing+pdf PDF link annotation
- https://ribijiwazafi.weebly.com/uploads/1/3/4/8/134881841/4380277.pdfIn PDF document text
- https://gulemexaw.weebly.com/uploads/1/3/4/3/134360266/1170116.pdfIn PDF document text
- https://mebirofaz.weebly.com/uploads/1/3/5/3/135384836/woloneminebifud.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4370541/normal_5ffa210fe23be.pdfIn PDF document text
- https://finuredapek.weebly.com/uploads/1/3/4/3/134352460/fd2a1bab1f72.pdfIn PDF document text
- https://kemosufasegu.weebly.com/uploads/1/3/4/3/134348140/xepimobane.pdfIn PDF document text
- https://zisugopijelides.weebly.com/uploads/1/3/1/4/131438068/kibewag.pdfIn PDF document text
- https://dasewukux.weebly.com/uploads/1/3/5/9/135956745/fiwikab.pdfIn PDF document text
- https://mijonogopo.weebly.com/uploads/1/3/5/3/135327524/vudevanonabafax.pdfIn PDF document text
- https://zizolewezefid.weebly.com/uploads/1/3/4/7/134702939/kabutidenowutasamor.pdfIn PDF document text
- https://dojarugakafep.weebly.com/uploads/1/3/4/4/134471698/d1df24.pdfIn PDF document text
- https://wazumiwu.weebly.com/uploads/1/3/6/0/136038811/tuvekebomirene.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4471099/normal_6018c2e789036.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5488c3e2-bb84-4e83-aae0-bbb02312392b/tablas_trigonomtricas_para_imprimir.pdfIn PDF document text
- http://supatibu.pbworks.com/f/nadebuzuletiloweroreno.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1063002-ab44-4da1-8d98-24c5f6b58eda/saxebibizakewunogigovuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dae29e16-6b21-4630-8803-3af284c30495/xigezetesuxole.pdfIn PDF document text
- http://mapijakemifo.pbworks.com/f/96726693577.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d02e4671-477c-4521-96cd-a1a4b1b30003/bibetibuxagerenewidubeke.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010f93.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F93 | 5432 bytes |
SHA-256: 8a599a54013d02d5bc9ad8ac70df8d6a7bac5307695e86e880a88943622f4fa6 |
|||
font_01_sfnt_off000121bb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x121BB | 6196 bytes |
SHA-256: a2c1cc6ff58d26b1194b5745a66227c36f468ebb3640feafc9f8aa9c549ddac0 |
|||
font_02_sfnt_off000130c8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x130C8 | 11328 bytes |
SHA-256: 2e135273f6128431c7d0e11d4feedd13134931bd8d2db480cabc0fb7814d6e08 |
|||
font_03_sfnt_off00015706.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15706 | 16172 bytes |
SHA-256: 852e0d6ce07a1db2e11154f4548aec4dc29a2cf073112f8b6a2b4be1be4894b3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.