MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.7645
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/aws?utm_term=what%2527s+the+hardest+song+on+beat+saber PDF link annotation
- http://xagekofa.iblogger.org/harman_xxv_pellet_stove_distribution_blower_not_working.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4381756/normal_5fe57de940717.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366398/normal_5fee4f98d9872.pdfIn PDF document text
- http://bavomobes.22web.org/what_are_the_complex_solutions_for_x2-2x50.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385880/normal_60555e8c89fb9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387218/normal_603b0c8aac5ae.pdfIn PDF document text
- https://e9abb47e-19e5-4ec2-9f3c-2aa4e6f2bf0a.filesusr.com/ugd/92be99_440daa74cb6743b6956de4dfde8b7bd2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/81697e31-e03d-40ff-9d2c-c2e6a6225f83/haier_portable_washer_manual.pdfIn PDF document text
- https://s3.amazonaws.com/marimejerebo/panasonic_es8243a_replacement_blades.pdfIn PDF document text
- https://s3.amazonaws.com/xufaxoferugod/supersport_3_tv_guide_kenya.pdfIn PDF document text
- https://2c8134a4-d865-4da1-8961-c755d7242105.filesusr.com/ugd/6dcf04_f30b2f6a8f4f4571a9db52298b4c3c93.pdf?index=trueIn PDF document text
- https://18e99e0c-7034-4a8c-9069-267580a295b8.filesusr.com/ugd/b337f5_39f77aca27d849f29602f919b7d4538e.pdf?index=trueIn PDF document text
- https://959e49da-b405-4961-97d4-5c1bb2e9a628.filesusr.com/ugd/ab0441_dc43460b56e24c489512c2916ce7541f.pdf?index=trueIn PDF document text
- http://winovonisalupib.rf.gd/cellulite_dentaire.pdfIn PDF document text
- https://s3.amazonaws.com/farowug/ripakumukuf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbbb9f91-672b-4763-986e-634738cfe716/prayer_not_to_die_young.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0165db31-fcca-40ce-997a-d02e02989c25/vamovenoja.pdfIn PDF document text
- https://a96990da-dd17-4b11-844c-aba2d588d1b6.filesusr.com/ugd/5e5e7b_b0e62dddaa624b85ae67297f7666c83b.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/titugome/cellular_organelles_worksheet_answers.pdfIn PDF document text
- http://besuwodusibix.rf.gd/cognitive_restructuring_decatastrophizing_worksheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5740d07d-87fc-4307-b6dd-1debd533a53e/olympus_tough_tg-5_vs_tg-6.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.