MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file, detected as malicious by ClamAV and an ML classifier, contains numerous embedded URLs, many of which are part of a link farm on disposable hosting. One prominent URL, https://chcial.ru/pbw?utm_term=mapa+metro+lisboa+2018+pdf, is presented as a map of the Lisbon metro, suggesting a lure to redirect users to a potentially malicious site. The presence of external URIs and the link farm heuristic indicate an attempt to distribute malicious content or phish users.
Machine Learning
- Nyx PDF Classifier malicious score 0.5495
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://chcial.ru/pbw?utm_term=mapa+metro+lisboa+2018+pdf
- https://rujazako.weebly.com/uploads/1/3/4/4/134471695/6e3deb4f41c89.pdf
- https://cdn-cms.f-static.net/uploads/4368219/normal_606b5de6d4012.pdf
- https://static.s123-cdn-static.com/uploads/4471686/normal_6002ac364382d.pdf
- https://static.s123-cdn-static.com/uploads/4445116/normal_6002bc9197c0d.pdf
- https://cdn-cms.f-static.net/uploads/4459922/normal_5fd2fbd40480e.pdf
- https://fedubipogumuwu.weebly.com/uploads/1/3/1/3/131379546/96d80bdcc5.pdf
- https://static.s123-cdn-static.com/uploads/4447273/normal_5fef7210cec15.pdf
- https://cdn-cms.f-static.net/uploads/4453537/normal_6062f0eca8ebb.pdf
- https://cdn-cms.f-static.net/uploads/4477155/normal_6063a8b16486b.pdf
- https://kinixudowobi.weebly.com/uploads/1/3/5/3/135399761/2632756.pdf
- https://voxapuxunud.weebly.com/uploads/1/3/1/3/131381802/wunubuwugovesow.pdf
- https://tupinikuwexopej.weebly.com/uploads/1/3/1/0/131070806/7638053.pdf
- https://uploads.strikinglycdn.com/files/f30fe4e0-8a18-4ccb-9555-ad35d814f806/pimurabatidilixetida.pdf
- http://gaxoxim.pbworks.com/w/file/fetch/144421428/nejivikarewobag.pdf
- http://dijakezepo.pbworks.com/w/file/fetch/144458160/ode_to_joy_2_remo_drive.pdf
- https://uploads.strikinglycdn.com/files/3ccb0c8c-52db-4075-a992-fc0c15d2ede8/38850101971.pdf
- https://uploads.strikinglycdn.com/files/3affdf4e-88bf-4b72-87c1-71e0f5751402/asus_rog_maximus_viii_hero_alpha_drivers.pdf
- https://uploads.strikinglycdn.com/files/aa5f18d2-9436-451e-91d1-dd5812989f02/75636699987.pdf
- http://naxenuve.pbworks.com/f/how_to_unlock_your_phone_carrier_for_free.pdf
- http://pokuwatosat.pbworks.com/f/how_do_i_download_google_authenticator_on_my_iphone.pdf
- http://ziduzobif.pbworks.com/f/photosynthesis_lesson_plan_high_school.pdf
- http://bupataved.pbworks.com/w/file/fetch/144428904/nailed_it_application_process.pdf
- http://moxulolo.pbworks.com/f/jatugawikafetomoxonoda.pdf
- http://supatibu.pbworks.com/f/nadebuzuletiloweroreno.pdf
- https://uploads.strikinglycdn.com/files/b565cdb8-08e3-432f-9122-14c13a9df408/john_deere_260_disc_mower_parts_diagram.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.