MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous external links, with a critical heuristic identifying it as a PDF link farm. The document body, though heavily obfuscated, suggests a lure related to 'Tractatus logico-philosophicus pdf español completo'. The presence of multiple Weebly-hosted PDF links indicates a potential phishing or SEO manipulation campaign. No scripts were extracted, but the overall structure and link farm heuristic point to malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafficel.ru/123?utm_term=tractatus+logico-philosophicus+pdf+espa%25C3%25B1ol+completo
- https://fepobiwebefu.weebly.com/uploads/1/3/4/5/134592484/fudevakesegudif-nadid-nanekapeme.pdf
- https://nokesopupikes.weebly.com/uploads/1/3/4/7/134767934/goxujum_zumama.pdf
- https://mokitigek.weebly.com/uploads/1/3/1/6/131606839/musux.pdf
- https://piwebodowumogoj.weebly.com/uploads/1/3/4/8/134857209/aef5fdfdce10b8e.pdf
- https://gesinanafu.weebly.com/uploads/1/3/4/4/134481382/d8c42ca.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/cfa95c52-1b77-4b1c-9450-b5dffc3dad8a/15299080013.pdf
- https://static1.squarespace.com/static/5fdcab432373c863b887b4f8/t/5fdd07b2ed5d2a1bbdf67c30/1608320947276/delta_model_14_bandsaw_manual.pdf
- https://uploads.strikinglycdn.com/files/333ca43f-6d2f-4c77-9850-bc352744f9a7/46055277349.pdf
- https://s3.amazonaws.com/dowadotiju/terufijovupoz.pdf
- https://s3.amazonaws.com/godoremitiwuja/rexuperumuvifo.pdf
- https://s3.amazonaws.com/zunaduxa/cheat_india_song_djjohal.pdf
- https://s3.amazonaws.com/nimuwet/98963270819.pdf
- https://static1.squarespace.com/static/5fce01bae1a8af6ff4aed778/t/5fd1841987bef85997e5ec38/1607566362489/knock_em_all_free_online.pdf
- https://uploads.strikinglycdn.com/files/9c0e5ffd-b8cb-4cc0-8cfd-cbdf88ba6f5d/juvakapovuretunekoretikoz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00016676.bin11d18f57fc799b20d028e96c511b4dea66e4fa1239791be28d429f8965b56df0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16676 | 5760 bytes |
font_01_sfnt_off0001799f.bin533a3060c4b0c59eb63f7d8c14fee4d784be208318c242ed4cf7a124f50e6b38 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1799F | 11840 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.