MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.6222
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/award?keyword=ielts+speaking+band+descriptors+pdf PDF link annotation
- https://gokaletuwatuni.weebly.com/uploads/1/3/6/0/136098233/1398040.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4489993/normal_5ff3bfee08a7b.pdfIn PDF document text
- http://inglassrus.ru/how_to_check_gigabyte_motherboard_serial_numberyzasm.pdfIn PDF document text
- https://cdn.sqhk.co/fulaxanew/hsgfjc8/daiwa_double_clutch_lures_bcf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455179/normal_6013350b95420.pdfIn PDF document text
- http://spainsale.pro/summary_of_novel_sense_and_sensibility_by_jane_austen234x7.pdfIn PDF document text
- https://xikagarema.weebly.com/uploads/1/3/4/4/134489929/xuxawogimotam.pdfIn PDF document text
- http://igcopyrightclient.com/sample_keto_breakfast_recipes95oqx.pdfIn PDF document text
- https://gerasulas.weebly.com/uploads/1/3/4/8/134861388/5cf35ec0838d2.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4474752/normal_5fe5aeb918f45.pdfIn PDF document text
- https://cdn.sqhk.co/xuvisisitinu/hcjdjh6/steel_and_flesh_2_new_lands_mods.pdfIn PDF document text
- https://tugofemupufere.weebly.com/uploads/1/3/4/5/134584107/45124.pdfIn PDF document text
- https://tijirurilulade.weebly.com/uploads/1/3/4/3/134312421/gawonifulexipezizoni.pdfIn PDF document text
- https://cdn.sqhk.co/moturalogupe/88haJAY/11654967528.pdfIn PDF document text
- https://cdn.sqhk.co/gaxumisi/hfuHUii/every_valley_john_ness_beck_lyrics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e6f34741-c9e7-4a4b-b54b-54d4eeba40f8/wsjt_x_2.3.0.pdfIn PDF document text
- https://d80868e2-5d34-4dda-9345-0396294a35aa.filesusr.com/ugd/f9fac6_ae371a03c3ea4c2aa618aca47f5b0ab6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6b21bcdf-0f6a-422a-84bf-33234d80d9d4/what_happens_in_the_first_stave_of_a_christmas_carol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e416284-b677-441e-98a9-fab2aa99dc0d/14485274916.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25070c2e-467f-47b1-986e-1d28d8289d33/cuanto_equivale_metro_cubico_en_litros.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f54a6010-9e96-4042-8ebc-823683415eb7/karoj.pdfIn PDF document text
- https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_daae48f461d74a988fb4342a6772ba68.pdf?index=trueIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.