MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9985
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/123?utm_term=carrier+superia+ac+remote+manual PDF link annotation
- http://puvepagawimideg.iblogger.org/mental_arithmetic_2_answers_free.pdfIn PDF document text
- http://rotelebi.22web.org/garnier_sheet_mask_vitamin_c.pdfIn PDF document text
- http://nalomojup.22web.org/font_chaparral_pro_bold_free.pdfIn PDF document text
- https://jubagidegugidok.weebly.com/uploads/1/3/5/3/135317658/7239974.pdfIn PDF document text
- https://zefakibafiv.weebly.com/uploads/1/3/1/3/131383453/risozujesa-kutar-gubinomebufika-lerujerome.pdfIn PDF document text
- https://dodapoxole.weebly.com/uploads/1/3/1/3/131398067/gejepaxu-fikulemezoweve-xodon.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://dafesofuxub.rf.gd/aleister_crowley_magick_liber_aba.pdfIn PDF document text
- https://s3.amazonaws.com/bitajemisajoz/sql_server_2016_localdb_32_bit.pdfIn PDF document text
- https://s3.amazonaws.com/xeponodij/moonkin_pvp_guide_3._3_5.pdfIn PDF document text
- http://muzizax.rf.gd/abacus_practice_worksheets_level_1.pdfIn PDF document text
- http://zinogagagobuv.epizy.com/john_lewis_bread_maker_recipes.pdfIn PDF document text
- https://368051e9-4199-40ea-b9a2-dc6e6f83cb3b.filesusr.com/ugd/6260fe_302258298bd44f649130d13b0975caff.pdf?index=trueIn PDF document text
- https://0f3c41ac-de96-4ba7-a517-026d7435d592.filesusr.com/ugd/8631de_66ee21209ad14818b50a58ce1b53760e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jazamerijekufol/escala_1_10_cuantos_centimetros_son.pdfIn PDF document text
- https://s3.amazonaws.com/wezukep/how_to_build_a_low_maintenance_home.pdfIn PDF document text
- http://zasegusof.epizy.com/80251351832.pdfIn PDF document text
- http://wutewak.rf.gd/what_is_a_water_resources_engineer.pdfIn PDF document text
- https://ca7c05ed-d233-4774-9cf9-08ff86aa6c73.filesusr.com/ugd/b42fd6_f3e718147ecf4ef691f8f7295a214d31.pdf?index=trueIn PDF document text
- http://poziluxolebulu.epizy.com/decontamination_and_infection_control_crossword_puzzle_answers.pdfIn PDF document text
- https://45dcde1a-aed5-4138-b95e-a0f768a283bf.filesusr.com/ugd/89441e_65102e4c7480447eb2061046f0985e1d.pdf?index=trueIn PDF document text
- http://nupadamemal.epizy.com/70093788067.pdfIn PDF document text
- http://kakekevuvek.epizy.com/wabezalenulimekikuxom.pdfIn PDF document text
- http://nawamejewiwuja.epizy.com/45641213872.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010532.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10532 | 4984 bytes |
SHA-256: 5d67e66145d8d5da989bf524c27534fbc1935f2bcee0a7b514a35c0851d2a077 |
|||
font_01_sfnt_off0001160c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1160C | 11012 bytes |
SHA-256: 9b29b8d6ffd0bccf886e420f1f6dccd7491f457045527d00a3ceb0c4cca9983b |
|||
font_02_sfnt_off00013ba9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13BA9 | 16460 bytes |
SHA-256: 8732ab670d9f8b9132543b5d92b2ebd08afbf61088a43f6d237208011202ba4d |
|||
font_03_sfnt_off0001521d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1521D | 2468 bytes |
SHA-256: c072ea695c07e1295ff3c5cb0b93db5d27923b407ee61222b311899be1aca0b5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.