MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9951
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/strik?utm_term=viper+alarm+system+installation+near+me PDF link annotation
- https://vikabedegopeve.weebly.com/uploads/1/3/0/8/130874339/b847d247.pdfIn PDF document text
- http://coins24h.com/ayrshire_housing_application_formzyavb.pdfIn PDF document text
- http://nout-prodat.site/powerdirector_15_user_manualwi4mj.pdfIn PDF document text
- http://khareedforosh.com/fonofotekiworawiravoxasl4acd.pdfIn PDF document text
- https://ronitodusod.weebly.com/uploads/1/3/1/3/131380212/d70e84a80eaa.pdfIn PDF document text
- http://lunesygets.xyz/6399440633oi4tc.pdfIn PDF document text
- http://topstop.site/impact_of_globalization_on_business_communicationhdfxj.pdfIn PDF document text
- https://gagividezi.weebly.com/uploads/1/3/4/4/134477411/5fe3d.pdfIn PDF document text
- https://vuzaruluweketex.weebly.com/uploads/1/3/4/4/134478477/39a1a132.pdfIn PDF document text
- https://xomuwesakutizid.weebly.com/uploads/1/3/5/3/135393414/10e8808fa00d.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tokudapele/hamlet_characterization_worksheet.pdfIn PDF document text
- https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_327e8bc28eec48ff97476da96d75002c.pdf?index=trueIn PDF document text
- https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_82fde2fa0c3a49498c1b1d581b8a7198.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/watajive/sennheiser_ew_300_iem_g3_in-ear_wireless_monitor_system.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87333be2-cb5a-4dbe-8f8a-801efcc25e76/bloodchild_and_other_stories_octavia_butler.pdfIn PDF document text
- https://s3.amazonaws.com/zafibimutadoti/safe_car_seat_stroller_combos.pdfIn PDF document text
- https://s3.amazonaws.com/fidobakipivogit/his_grace_reaches_me_sheet_music.pdfIn PDF document text
- https://s3.amazonaws.com/fujadabez/biwumewifelapinozok.pdfIn PDF document text
- https://f3c4034a-4a94-4c47-b6c5-0445626d7bf8.filesusr.com/ugd/655f09_e458df9b93ce441da7e0a255747b705e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/waxapoz/present_participle_exercises_with_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f94f3789-beab-4145-9258-e97588abd711/what_are_the_similarities_and_differences_between_c3_c4_and_cam_plants.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/142f636c-9d15-414b-9ab9-8fb2d816cdc7/what_happened_to_lisa_at_the_end_of_girl_interrupted.pdfIn PDF document text
- https://s3.amazonaws.com/vunizi/gali_satta_live_report.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42ada318-07f6-4cf5-bfbf-ece4ed55a59d/what_happens_after_the_stock_market_falls.pdfIn PDF document text
- https://s3.amazonaws.com/lixuzo/android_16_vs_cell_jr.pdfIn PDF document text
- https://s3.amazonaws.com/vapelurowar/bssc_graduate_level_notification.pdfIn PDF document text
- https://67dec473-0a9c-497c-80b1-62a4c84c5046.filesusr.com/ugd/0aab01_6b98c1e1ea2143a5b906bc27542a93a1.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000100f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100F1 | 5032 bytes |
SHA-256: 1b3492bc8d2b9b68b8346fea14c68a2b6f5182cbf188123df075cb417a7a0817 |
|||
font_01_sfnt_off00011203.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11203 | 11296 bytes |
SHA-256: bb1d8935abe75845c5639323c96cb9a299a44726216bc5d5bcd029d8aeb68504 |
|||
font_02_sfnt_off000138aa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x138AA | 16060 bytes |
SHA-256: d1a84ba8f0e4a827a048d387db8dd5dae3538f1c7e72415b16af587a9947cdc7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.