MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9982
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pelibifir.ru/123?utm_term=arch+linux+i3 PDF link annotation
- https://cdn.sqhk.co/jigugabopu/7XOgjW1/shelter_in_place_arizona.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367305/normal_601d15fa5f37f.pdfIn PDF document text
- http://jesiguvolen.22web.org/beautiful_in_white_fingerstyle_tabs.pdfIn PDF document text
- http://nextauto02.ru/97666929456zzycg.pdfIn PDF document text
- https://tewamuwomipatus.weebly.com/uploads/1/3/0/9/130969874/1676655.pdfIn PDF document text
- http://easterthjg.com/books_of_the_bible_list_new_testamentf21c2.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4496816/normal_5fd03be64f607.pdfIn PDF document text
- http://bufo.online/72313517398leslc.pdfIn PDF document text
- https://cdn.sqhk.co/fimegasaz/hjgfigx/rock_radio_stations_fm_near_me.pdfIn PDF document text
- https://cdn.sqhk.co/medipevagopu/jdjijbA/overkill_meaning_in_marathi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385216/normal_6016d5665ac33.pdfIn PDF document text
- https://panejukirid.weebly.com/uploads/1/3/1/6/131606092/ca4acadc3.pdfIn PDF document text
- https://cdn.sqhk.co/nivodoruw/jg9lmXa/nesixigatisazen.pdfIn PDF document text
- http://jiviruke.iblogger.org/rasawatog.pdfIn PDF document text
- http://montana-media.com/introduction_to_probability_and_statistics_milton_and_arnold_4th_editionvccow.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454047/normal_5ff47c6be5174.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4367013/normal_5fdee6e705bcd.pdfIn PDF document text
- http://bimamoked.iblogger.org/lexus_es300h_hybrid_electric_sedan.pdfIn PDF document text
- http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/465788a3-4c0f-4dcb-8ec3-5c8b8e2772fd/3872602338.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7bc60cd0-c714-4366-92bd-2587eb1c23f1/how_to_pair_an_xfinity_xr2_remote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c813ae67-57b8-446e-90b8-a8180f036bbf/kovebizexiravozixif.pdfIn PDF document text
- http://gikosetopetidun.rf.gd/ayreon_universe_live.pdfIn PDF document text
- http://vezapuro.rf.gd/business_development_process_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011b38.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B38 | 4676 bytes |
SHA-256: f57629f056008b1afb2956027543320054c1030b684df62c38093c33feb0ee6a |
|||
font_01_sfnt_off00012c1b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12C1B | 4720 bytes |
SHA-256: 55f98062705d32f32046c2ff5b5bb74414b46fe2817e7f0b5764e7ff0f4711e4 |
|||
font_02_sfnt_off00013c30.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13C30 | 13708 bytes |
SHA-256: 24a18b82144ec9365a2a1404590239f50a9fbcef1b1d328e71e9ed23fe7c3a2b |
|||
font_03_sfnt_off00016889.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16889 | 16116 bytes |
SHA-256: afbdbd02dec82d9be1e07df9ab92004d6e2996c86bdcb9c83a2c1f8ac0d08daa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.