MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://synerhu.ru/pbw?utm_term=avengers+film+list+order PDF link annotation
- https://cdn-cms.f-static.net/uploads/4482027/normal_604e11082d392.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4375704/normal_6003f97f654f3.pdfIn PDF document text
- https://bibokesoxi.weebly.com/uploads/1/3/4/8/134850131/1667140.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4374517/normal_5ff5e53022659.pdfIn PDF document text
- https://polipofixino.weebly.com/uploads/1/3/4/5/134598506/fasuvusiz_kekuvilu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451375/normal_6051729f844d8.pdfIn PDF document text
- https://pakoverixofe.weebly.com/uploads/1/3/4/7/134771358/badezupurut_gafawik.pdfIn PDF document text
- https://veforolafumokiv.weebly.com/uploads/1/3/4/3/134340642/b1002a877.pdfIn PDF document text
- https://wejumarokurefa.weebly.com/uploads/1/3/0/7/130776247/kepelebusa-nasevaxasit-wedadimez-viwudipaji.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4505687/normal_5fc89bfa6c89f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/03a68ff5-33f5-4b5b-bfb7-19db5f94ceca/best_minecraft_bedwars_server_ip_address.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fcbccd04-3180-4e1a-8f7e-a7fe07c7e74f/82209580800.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68c4014e-7d25-4888-9f32-5d1bd6a96c23/zuvegovuvugiwararej.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c59190d3-acd8-44dd-8937-2c7a0bf7f4d2/46223448952.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68d7251a-588c-4978-b0d7-0eb4c9f39e2e/japanese_from_zero_download_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/41a53c91-cc74-4871-b16e-d56d49de0c6d/adding_and_subtracting_scientific_notation_worksheet_math_aids.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/63f7b582-1732-49db-8b48-87dbcf4ff93b/what_is_the_main_purpose_of_tort_law.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d895f62-64d6-406b-a8a7-413ad8b3deb3/52899697460.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc58d3ac-2253-49b2-88e0-22c1bc9a7297/how_to_cook_tamales_in_an_electric_roaster.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01f2d99d-654d-437b-82ba-aadfaf91e921/hayward_ecostar_pump_motor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d484a12-46b3-4dc3-94ec-b759242d0d06/zujivatabowonudexased.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2e94f6b-5bbb-464e-babe-56e41a971fdf/movox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c29aab5c-c33e-4bb8-b8d3-ab98cce08e51/wuwoninajeluloxobog.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e604.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE604 | 5068 bytes |
SHA-256: 4ae99fb60b681d200ec8b7c50e83266a03d523be6b4ed5b597ed7cb958cbfb29 |
|||
font_01_sfnt_off0000f73b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF73B | 11368 bytes |
SHA-256: 24a22127ef560027262354132b5e34fe0af5524adc9fcfbcd04fbdd91c318907 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.