MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=fiitjee+aits+papers+free+download+2017 PDF link annotation
- https://zematewisa.weebly.com/uploads/1/3/4/8/134897668/8680104.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453885/normal_5fd2f88ce4b03.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413590/normal_6004e81f71789.pdfIn PDF document text
- https://bokepamukabina.weebly.com/uploads/1/3/5/2/135293240/c95f30b1.pdfIn PDF document text
- https://xonutadeb.weebly.com/uploads/1/3/0/7/130775355/3518068.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4461509/normal_603e26f3350de.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382186/normal_60020a6050a26.pdfIn PDF document text
- https://rejasujewefem.weebly.com/uploads/1/3/0/7/130738882/dumenet.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384825/normal_60444b133eb51.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fadba309-3eb5-4dc0-8686-88f2d16916d4/is_ammonia_ionic_or_molecular.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dae3677b-7919-4614-a280-c8cdfdca4cf4/4090134074.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dac433dc-310e-4a07-b827-b5933f28c336/harry_potter_year_5_movie.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8f39f87d-e9c6-4f16-874b-a900f9759202/dell_latitude_e6530_i7_15.6_windows_10_laptop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85e908db-38bf-49f6-b5db-bdefcafa89ae/sw_testing_tutorial.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0b144f8d-8a94-46bd-ac02-5ad094664adc/midesugoz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85c41806-3489-459f-a8f4-a42ccab58908/saxozinigumotofijilerozup.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5ebec9d8-6392-4945-9f89-fca1d4dc92a6/baldi_basics_game_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7374e13d-dfff-4c62-b9ef-1d8a624b9319/how_to_change_a_unisaw_motor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/76304148-7f93-496f-b9a0-1624f33c4d7a/mr_coffee_bvmc-tjx37-rb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5e34004e-ecf7-4d2c-be18-94cd61ea0d29/1408_stephen_king_summary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/649deb70-fa30-4eb4-add6-0a3f2d4d2361/shadow_run_riverview_directions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/39e77ffa-b3ec-47a4-937f-653664f58693/what_does_lima_india_foxtrot_tango_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4cfb134-4ec0-4ac2-bc5f-59c692cc20dd/the_basic_practice_of_statistics_6th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f1fe6303-b32c-4133-99cd-f7ad7c2e121c/is_my_xbox_one_controller_bluetooth_compatible.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dbee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDBEE | 5564 bytes |
SHA-256: 1296268b56232ad37f93ea56c4be964b435030cd3f91c5db335dfe9c1e592ce0 |
|||
font_01_sfnt_off0000ef0c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF0C | 11740 bytes |
SHA-256: 0351e2bb5fa5df98b414312214c3f51daa56150064a69d8829f2c406c5b3d4e8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.