MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/123?utm_term=canon+digital+photo+professional+software+free PDF link annotation
- https://static.s123-cdn-static-d.com/uploads/4384822/normal_60b75c0e6dbb1.pdfIn PDF document text
- https://nuwukovodikala.weebly.com/uploads/1/3/4/6/134666266/3d43c7f2cb3f4.pdfIn PDF document text
- https://penaveligatoka.weebly.com/uploads/1/3/4/3/134314422/455339.pdfIn PDF document text
- https://kujiviremi.weebly.com/uploads/1/3/2/3/132302989/wiwafurobe-pawapib-zogitij.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409623/normal_6017212794ef3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415936/normal_603090ecd1618.pdfIn PDF document text
- https://xovelojedawoka.weebly.com/uploads/1/3/4/6/134662979/5650996.pdfIn PDF document text
- https://musibagufes.weebly.com/uploads/1/3/4/5/134587398/jejexuwiz.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4463560/normal_603e6cd510108.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482854/normal_603a6598044cb.pdfIn PDF document text
- https://mafupixalikufu.weebly.com/uploads/1/3/4/6/134662523/jolale.pdfIn PDF document text
- https://ladevizeloraben.weebly.com/uploads/1/3/1/6/131606454/gebutukil_vurowubavisa_levegazufugavex_galubave.pdfIn PDF document text
- https://nesupopokajore.weebly.com/uploads/1/3/5/3/135394324/202128.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383314/normal_5fe98d249aa4e.pdfIn PDF document text
- https://finelesazik.weebly.com/uploads/1/3/4/7/134715738/4cba11.pdfIn PDF document text
- https://zazobowelukoki.weebly.com/uploads/1/3/0/9/130969428/be742bcdd.pdfIn PDF document text
- https://balijijileg.weebly.com/uploads/1/3/4/5/134505585/2949450.pdfIn PDF document text
- https://poxotedodesogin.weebly.com/uploads/1/3/4/3/134305686/c4caba43e4e2e25.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4390328/normal_5fdcf9906a942.pdfIn PDF document text
- https://mijagipiked.weebly.com/uploads/1/3/4/5/134524971/8342106.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/ab3d7db7-cc50-4350-9c6a-5a05249f2a79/is_blackweb_iphone_charger_good.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/77781e78-1e6f-4417-8306-2b6c8a5d6a5f/duvulosijebatotila.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d3be3305-6b91-4ed0-848d-2d2317e8d1b9/kobeb.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7a2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7A2 | 5300 bytes |
SHA-256: bfa51597c7d9dafac3676d0f2e14734fdd6a7492558cded4da34336a170b7727 |
|||
font_01_sfnt_off0000f9b4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9B4 | 10632 bytes |
SHA-256: 296e241d460783ba81d6ed3924bb672a865e6cc8e69fd2eba81f1e353c8b7c95 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.