MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ClamAV and an ML classifier as malicious, with critical heuristics indicating it contains a mass external PDF link farm. The document body, though heavily obfuscated, contains references to 'acg practice guidelines acute pancreatitis' and authoring application details, suggesting a lure. The presence of numerous external URLs, many hosted on file-sharing or personal web services, strongly indicates a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/123?utm_term=acg+practice+guidelines+acute+pancreatitis PDF link annotation
- https://pakipuxis.weebly.com/uploads/1/3/5/3/135347710/torikawetun.pdfIn PDF document text
- https://fukenotaza.weebly.com/uploads/1/3/2/7/132740373/xukabemaf_xuwosokok_lefasosesasap_xatawimazexe.pdfIn PDF document text
- https://xaminipa.weebly.com/uploads/1/3/1/0/131071220/timulazabibakuki.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453909/normal_5fe9811eafa2a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489257/normal_606a00c1246e6.pdfIn PDF document text
- https://jijovozezara.weebly.com/uploads/1/3/1/1/131163872/pudodewovugamibi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4486353/normal_605c3a7ca389a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480173/normal_603efb60b46ab.pdfIn PDF document text
- https://bevozuvegala.weebly.com/uploads/1/3/3/9/133999301/tufojenalixole.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454179/normal_600fce93f272b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/14dfc5b3-d090-4caa-b276-97fc64d9b135/78256108227.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f72b4d8a-0f13-400b-a643-a78efc974d66/21999388523.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/27ec00a3-da14-4d7f-bcb8-a20ba0bb123b/lafetediririraforori.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55de736c-b132-4e0d-8052-1b5c9f0bce7a/kalumudomepaburujivatiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c9f4d790-69ad-46ba-94bf-033d744dc477/25603688163.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c021af70-7f07-4ef1-be04-69e3a4d6755f/romeo_and_juliet_act_1_scene_2_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f04b4e66-ee4f-42cf-9957-7dfe02bb4252/hp_3050_printer_driver_windows_10.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66268da9-bf6c-4569-bb50-582740d7d6fe/pebinesixekoteposusuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/68e2908f-b9e4-4009-9446-6d658042fb0f/19244254062.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5a0398d-acdd-4c97-b960-eeb178c03ede/etapas_del_proceso_de_investigacion_documental.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/16bd886d-0823-4343-92c3-077a904ce98a/lenovo_thinkpad_t420_ram_slots.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/87165c3b-bbc4-4a37-8b06-e9c4a302b025/what_is_the_role_of_technical_writer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c291aacb-4fd5-4d89-97cd-0f1e074e5e82/child_maintenance_plan_template.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000109a2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109A2 | 5232 bytes |
SHA-256: 14fc7a27e04f2e7b7208c16b71e4a5cac29b4fb79f7a9f057f51d3f3f90c7851 |
|||
font_01_sfnt_off00011b7d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B7D | 11816 bytes |
SHA-256: 14ee171e502d3b3c877a41466fd9d8e840fc16fc434afaba512c2c34a9b908b7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.