MALICIOUS
214
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://garglob.ru/pbw?utm_term=school+of+dragon+mod+apk+whatsappstatusimages.com In PDF document text
- https://static.s123-cdn-static.com/uploads/4403140/normal_5fe43fa4de2c5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425759/normal_600a4f8cd02f3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383923/normal_60465698c1e26.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415767/normal_5fd991a65d398.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366987/normal_606040d3600c6.pdfIn PDF document text
- https://ximilebikunupi.weebly.com/uploads/1/3/4/8/134875253/7284429.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443602/normal_604cf37870013.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403141/normal_60473244b6517.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4408873/normal_5fde696bef25b.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4482645/normal_60b6d4a8a2895.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451762/normal_602a76f206a20.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450003/normal_604f3390c3ff0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417659/normal_6026ed9bb26eb.pdfIn PDF document text
- https://bekazavaf.weebly.com/uploads/1/3/5/3/135327011/vedivararivam_zitavajoguwiti_vemodozadake.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369927/normal_5fc6a8e15071b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366630/normal_5fccefcd694dd.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/d0ac6dd9-b2fd-43ff-a64f-e5b7ca73ff43/diruduve.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f0a6e2a1-553d-4072-8de4-16a8b86028e7/56307056955.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f87f520-3017-4cff-b8da-97d89a0eafda/53303942842.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25f336fe-d1e4-4922-bb01-f2d84b02ab80/what_are_the_6_major_land_biomes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/74daa57b-1efe-4790-bf35-5af74338b4c4/carl_jung_books_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc35c5b1-6414-4d4d-9ec3-8152807ebeb8/89472477710.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68dbc499-50f6-408d-baa5-381b3cfb1d20/cinderella_and_four_knights_episode_6_eng_sub_dramacool.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eebf18db-a992-419c-a42c-092df8eba76a/54014308662.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2742a16-f88a-44ac-a74a-c36090499a44/kanger_evod_mega_1900mah_electronic_cigarette_starter_kit.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e926.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE926 | 5860 bytes |
SHA-256: 671a7afd8212dda06b1ed1b1df7fbbba99488986f1ca2df497200d544c6b37f6 |
|||
font_01_sfnt_off0000fd04.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD04 | 11660 bytes |
SHA-256: ee0b621b24a0e29cc1fe941096afc057ed7b518e48c15c365abcdb64bb3fc464 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.