MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to redirect users. One prominent URL, https://botokaw.ru/123?utm_term=employment+application+form+singapore+sample, is presented with a query parameter that mimics an employment application, likely serving as a lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=employment+application+form+singapore+sample PDF link annotation
- https://cdn-cms.f-static.net/uploads/4387810/normal_5fdbc4e0e3b27.pdfIn PDF document text
- https://fipamowusaki.weebly.com/uploads/1/3/4/8/134879766/pixiwanolinufu-vujewe.pdfIn PDF document text
- https://fukikabigo.weebly.com/uploads/1/3/4/4/134457586/3826980.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478123/normal_5fd672f527a44.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4422879/normal_5ffe7194dc7df.pdfIn PDF document text
- https://masezinonorokun.weebly.com/uploads/1/3/4/6/134685416/dovuvijixawu-limupa-sewojenuwetete.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470836/normal_60108cec724b1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405185/normal_60288dd162bee.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://696f1bd8-06c3-47a7-a8f7-e83e17ec8d18.filesusr.com/ugd/5ad03d_34c0c63c1dbb4566b841057188b1aff1.pdf?index=trueIn PDF document text
- http://tekarileted.epizy.com/who_sang_the_original_version_of_auld_lang_syne.pdfIn PDF document text
- https://e5b7f393-9b83-42c5-a877-5b85c0c772c8.filesusr.com/ugd/77b42d_f8e57141e37e45969d74d00ea7f25b09.pdf?index=trueIn PDF document text
- http://kovemipenege.rf.gd/rozuxokufarunebidug.pdfIn PDF document text
- https://f33d1b56-f518-462b-b61f-c1b5c1ba661c.filesusr.com/ugd/1c44ce_df0bb72ed74d4860ab1b2a6102e0be0b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dozuga/zivovomowuredolor.pdfIn PDF document text
- http://gijawiravutul.epizy.com/bhagavad_gita_in_simple_tamil.pdfIn PDF document text
- http://runozozupegefo.epizy.com/cattell_personality_theory.pdfIn PDF document text
- https://s3.amazonaws.com/gedesisumi/chomsky_normal_form_converter.pdfIn PDF document text
- https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_cd26d1860ca3440eb6cd815532462692.pdf?index=trueIn PDF document text
- http://wiwifubobu.epizy.com/vexekekefetilukoguxutozu.pdfIn PDF document text
- https://s3.amazonaws.com/gumegulaxi/bitom.pdfIn PDF document text
- https://5b2b9875-3923-4577-9ef6-0527498c95e7.filesusr.com/ugd/4e6dd5_fe3c18e22b004e3aa936e1b9cdbf3f82.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ropuba/electronic_press_kit_design_template.pdfIn PDF document text
- https://s3.amazonaws.com/gosete/how_to_make_homemade_butterbeer_from_harry_potter.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efa0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFA0 | 5396 bytes |
SHA-256: 8d5aafa52c6fb19eb0cb4abb3879fbd4e12a261ad9fb44d1dc9d70724f658b7f |
|||
font_01_sfnt_off000101f3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101F3 | 10288 bytes |
SHA-256: c04a724166135b006efbcd0239c3d51c4ca411cec578a300049b06d6e341defe |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.