MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9953
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/wix?keyword=beatty%2527s+death+fahrenheit+451 PDF link annotation
- https://fotekexilinita.weebly.com/uploads/1/3/4/2/134235887/mozurutujuxukexi.pdfIn PDF document text
- https://cdn.sqhk.co/konidadelan/Bhxheic/gaguloxasepu.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371786/normal_5ff658b69a557.pdfIn PDF document text
- https://cdn.sqhk.co/sofawaju/dLge5hg/ronivi.pdfIn PDF document text
- https://bofazereb.weebly.com/uploads/1/3/4/6/134675062/c275f44568.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4467573/normal_5febd822d37a0.pdfIn PDF document text
- https://nasuvanebi.weebly.com/uploads/1/3/5/3/135393195/juxivoviselidepo.pdfIn PDF document text
- https://cdn.sqhk.co/lepavenujal/xhiiie9/gun_strike_free_special_force_mod_apk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374522/normal_601041491ff96.pdfIn PDF document text
- https://cdn.sqhk.co/nezusoxe/gfn7hgs/jirizewolisu.pdfIn PDF document text
- https://cdn.sqhk.co/gikokimofegi/i5hbjaZ/i_f_s_full_form_in_marathi.pdfIn PDF document text
- https://poxejoretojav.weebly.com/uploads/1/3/4/7/134740271/5327132.pdfIn PDF document text
- https://soremezu.weebly.com/uploads/1/3/1/0/131070226/99c5d0c4be3ed5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://lakugarim.rf.gd/widetoravadatozoror.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/034fd905-a745-415e-aff1-f8f7460104e6/beatles_sheet_music_for_piano.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a15a81ec-69ce-4b1f-be38-deafef78987b/malaysia_lonely_planet_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0da7cea8-fe4b-45e1-ba3b-16ae5c40074b/sogonelatiluma.pdfIn PDF document text
- http://widurema.epizy.com/pirifumuzewok.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eacd1a32-1f92-442a-b167-d84fc7805e67/61167705163.pdfIn PDF document text
- http://gumavefuve.rf.gd/rifosafozip.pdfIn PDF document text
- https://0c6b7a74-1ca0-41da-943c-c268a208a416.filesusr.com/ugd/fef373_475261837b7044519b11db5477f56c73.pdf?index=trueIn PDF document text
- http://javewexo.epizy.com/29455986847.pdfIn PDF document text
- https://404c0e03-56c4-4888-bb84-d9d32a71a3e4.filesusr.com/ugd/100e2e_a74fd7ec100d4674b375b7c41804e80a.pdf?index=trueIn PDF document text
- https://98cdd5c5-c43e-49eb-9373-39517e896cbb.filesusr.com/ugd/90661f_b1925fd81ba64ea09ef63ea6affa1211.pdf?index=trueIn PDF document text
- https://02e0da19-eac5-4521-950b-4e410541bf1c.filesusr.com/ugd/516249_7ba7f5ebf93c412586c5ba6867c429dd.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3c0efbc2-0f2c-4940-b578-80d5bd07dec0/fishman_aura_dreadnought_review.pdfIn PDF document text
- http://jepevam.rf.gd/nijanogewetawiputeli.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00022de8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x22DE8 | 5412 bytes |
SHA-256: 88049b3a55377ba16bbffb219018a5096e541f88089d92ff10486484dee913ac |
|||
font_01_sfnt_off0002406a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2406A | 12656 bytes |
SHA-256: 9950321e774edf6816d1edfec7ec086205ea760b99345783a2a3a0500225649c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.