MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, with a significant number pointing to SEO-optimized PDF link farms. The primary lure appears to be related to car specifications, as indicated by the URL containing '1994 honda accord ex specs'. The presence of a PDF_SEO_LINK_FARM heuristic suggests a large number of outbound links, likely intended to redirect users to malicious sites. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/aws?utm_term=1994+honda+accord+ex+specs PDF link annotation
- https://purelukanixavaj.weebly.com/uploads/1/3/1/4/131454065/1300427.pdfIn PDF document text
- https://rokejowavati.weebly.com/uploads/1/3/4/2/134265467/4101115.pdfIn PDF document text
- https://xaweworamek.weebly.com/uploads/1/3/4/6/134610398/d906638c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445334/normal_604147656a918.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385850/normal_602f73bcbaec5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4448558/normal_5fe108c72fb37.pdfIn PDF document text
- https://kuwumezebuxe.weebly.com/uploads/1/3/4/1/134131528/genubapabaxokeb.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383794/normal_5fd824c93fde7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jifesu/lusoxojuseserulotu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f63bc601-1874-4f4d-aeb9-e92ce5ace40d/toyota_corolla_2009_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22eaded1-efda-4d19-911f-61c1c8671985/zegixozevodepojaxeda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f0cd5ea2-5e89-4629-a73a-56bda9ab0858/pumem.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e97bc179-be70-4086-b2bf-5f5a451c11a3/how_to_get_unlimited_money_in_simcity_buildit.pdfIn PDF document text
- https://s3.amazonaws.com/kavugusepe/bomb_squad_character_mod_apk.pdfIn PDF document text
- https://s3.amazonaws.com/puretulenuza/98132223550.pdfIn PDF document text
- https://32e47638-7206-44c1-ad53-5c6f9176402e.filesusr.com/ugd/e00742_a06bb431864c47fc9ee6303df264b944.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/desenaz/20513868342.pdfIn PDF document text
- https://s3.amazonaws.com/dogazisuze/in_on_under_worksheet_with_answers.pdfIn PDF document text
- https://s3.amazonaws.com/nevowimo/champion_sweatshirt_size_guide.pdfIn PDF document text
- https://s3.amazonaws.com/nitatotol/28186081081.pdfIn PDF document text
- https://f238abdf-92e3-4651-90df-65b6e8a648d9.filesusr.com/ugd/99965f_4fb548b4800445c48181946ff8baafd5.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/zumomasugipeno/veroruvuridifabojetiv.pdfIn PDF document text
- https://1a413096-4115-453c-84a6-e19f3d0a1e7a.filesusr.com/ugd/4a2d03_1fd1545cf6844787984a6872d563e734.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011d9c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D9C | 5400 bytes |
SHA-256: cb873b3917423514e25b8e413345b9d865c7577e7215caafcc343fa5d38c248b |
|||
font_01_sfnt_off00012ffc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12FFC | 10572 bytes |
SHA-256: d643353ee8627aa55d6b4a365a187b55a8e9babf887d9c140a82d5cfbca66973 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.