MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is a PDF containing a large number of external links, identified as a link farm. The primary URL, 'https://botokaw.ru/strik?utm_term=how+old+to+work+as+a+cashier+at+walmart', suggests a potential phishing lure related to employment. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for SEO spam or directing users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/strik?utm_term=how+old+to+work+as+a+cashier+at+walmart PDF link annotation
- https://static.s123-cdn-static.com/uploads/4464539/normal_5ffab032b577e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424632/normal_605faad1246e5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4477863/normal_604f3d465b8ba.pdfIn PDF document text
- https://cdn.sqhk.co/lipetebo/fihaYhf/puvatejum.pdfIn PDF document text
- https://cdn.sqhk.co/jutepoxof/hjvSuih/sakagujugosimoliparupuj.pdfIn PDF document text
- https://cdn.sqhk.co/zatovafer/dXeNb9W/nenululari.pdfIn PDF document text
- https://zexojoru.weebly.com/uploads/1/3/1/4/131409474/583d9.pdfIn PDF document text
- https://motefeka.weebly.com/uploads/1/3/4/1/134108707/sawude.pdfIn PDF document text
- https://kozitasulama.weebly.com/uploads/1/3/4/6/134647404/d1940.pdfIn PDF document text
- https://cdn.sqhk.co/mewedenemez/Kjcykjb/business_strategy_game_quiz_1_2019.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4494874/normal_6056e7cf64da5.pdfIn PDF document text
- https://xorataseturife.weebly.com/uploads/1/3/5/3/135333409/mafifafuj-fafav-gikumat.pdfIn PDF document text
- https://mizunemaki.weebly.com/uploads/1/3/4/8/134850414/8ff0174e2b637f2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/826fca4a-c45b-4ddd-9f81-a02eaab765b9/12694453554.pdfIn PDF document text
- https://0df6220b-9630-4647-aab6-0d9db69b9d59.filesusr.com/ugd/8b97dd_937eb6e4e20c48209b4c8599b71a3a64.pdf?index=trueIn PDF document text
- https://8ed7ad90-0d0e-491f-9c15-1f6cd5a61d18.filesusr.com/ugd/f1a804_b5c0af449fab4046848a5aa93a1950d1.pdf?index=trueIn PDF document text
- https://18bc7be3-897e-46c1-a475-efc190d089bd.filesusr.com/ugd/62845f_e49b0180b152433b96572d199292ff47.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4b872484-0877-4fd9-a0ec-877873755006/forrest_fenn_treasure_location.pdfIn PDF document text
- https://d04c2b29-3777-4fe6-aaa9-ab96f87c3324.filesusr.com/ugd/43eb95_fb8e48afb8b1438395c337483b004044.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/996129bb-f6da-4f40-aafc-f1b035a07d94/dd_5th_edition_character_creation_flowchart.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c928f689-dcde-4b7a-9091-492fe8322eb9/53944510171.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00014f21.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14F21 | 5296 bytes |
SHA-256: 2de0b216f7f7ca8584b0415a27a73933a45659d66a1e26f68eba0d01a2a3b50e |
|||
font_01_sfnt_off00016105.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16105 | 11524 bytes |
SHA-256: abc029ca4184539e5a59c78c836ccc3efd3403a5118156631703699acff404a0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.