MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/strik?utm_term=how+to+setup+a+lowrance+elite+5+hdi PDF link annotation
- https://cdn.sqhk.co/lowanivari/hhdaggM/eye_structure_and_function_worksheet_answers.pdfIn PDF document text
- https://cdn.sqhk.co/leporolino/f7o8Hhb/lirobujapuzesedijewa.pdfIn PDF document text
- https://gizibufunete.weebly.com/uploads/1/3/4/4/134492386/taderodetosep-wiraridag-ruxeba.pdfIn PDF document text
- https://cdn.sqhk.co/zonakagud/jh6w7gi/vampires_show_netflix_review.pdfIn PDF document text
- http://eroganoficial.site/the_wretched_of_the_earth_book_cover3ygwk.pdfIn PDF document text
- http://instapriz365.online/los_juegos_del_hambre_sinsajo_parte_2212tb.pdfIn PDF document text
- https://wurixexaf.weebly.com/uploads/1/3/4/8/134865586/3242697.pdfIn PDF document text
- https://wezalowesugalu.weebly.com/uploads/1/3/2/8/132815960/a2dfb3b358.pdfIn PDF document text
- https://wokulenazaxur.weebly.com/uploads/1/3/4/7/134744474/lexitafonoj_pifik.pdfIn PDF document text
- http://digtalcaliper09.xyz/wolujofan10wwr.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://ef733714-782c-48ea-8991-1bc0bf0c95f2.filesusr.com/ugd/ad2ade_fa58def54f9941acb1ac19dfeccee9a3.pdf?index=trueIn PDF document text
- https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_1810595e369d4ed5a79ef8dd50bb20d3.pdf?index=trueIn PDF document text
- https://e26976e3-f089-44cc-a2a6-54bcc6cae308.filesusr.com/ugd/0df15e_28cd26d2dd8245239ec6bf519e47894b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/neporezofov/lurupaneripozibix.pdfIn PDF document text
- https://s3.amazonaws.com/fizufapu/navigator._online_not_working_in_android_webview.pdfIn PDF document text
- https://s3.amazonaws.com/somamere/free_motion_quilting_templates_acrylic.pdfIn PDF document text
- https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_252554e1b7fa4986bda136c62477b0e6.pdf?index=trueIn PDF document text
- https://beb587af-1766-4a1c-893d-8c04a9882fa7.filesusr.com/ugd/f3bec4_fb23e5909123487b9ee141e37dcd5206.pdf?index=trueIn PDF document text
- https://25f35837-e8ad-4357-b490-8f69bec4165a.filesusr.com/ugd/96c61c_221636d0429b42f18f781861992a5a6b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/punagilelabon/low_platform_wooden_bed.pdfIn PDF document text
- https://3e1ae61b-6b68-46dc-8a90-d1c7a5b9f91c.filesusr.com/ugd/b8bbd7_d189dfc0feb64daaba522372fc5bec64.pdf?index=trueIn PDF document text
- https://504706c9-3a86-45eb-876a-6494ef133fff.filesusr.com/ugd/80c1db_306841db8eae4b95931b9fb0c5642f68.pdf?index=trueIn PDF document text
- https://9462281c-6212-45c1-8f90-c4e3c363a226.filesusr.com/ugd/007d40_ab90bb1f0d0a4df39152fdf64a50c46a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/begijufadi/atualizao_gps_garmin_nuvi_52.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb1f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB1F | 5340 bytes |
SHA-256: d6b1bc0562a2e05c424f4c2cd5557c17b255ebff7b96f778ea8faffcae72153c |
|||
font_01_sfnt_off00010d51.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D51 | 10812 bytes |
SHA-256: 8429617329b562e2ed69646cd09074db765076d9920605faed65f28c9246c0e0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.