MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many of which are hosted on disposable domains or link farms, indicating a malicious intent to redirect users. The ClamAV detection and ML classifier strongly suggest this is a phishing or malware distribution attempt. Although no scripts were extracted, the PDF structure and embedded URLs point towards a tactic of using SEO-like content to drive traffic to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=fiddler+on+the+roof+cast+daughters
- https://cdn.sqhk.co/kagelemovo/48uijhh/zoo_virtual_tour_free.pdf
- http://xutiwavu.iblogger.org/jivefalojoduvozonodipum.pdf
- https://cdn.sqhk.co/fikalibumi/cieyiib/circulation_aha_guidelines_2005.pdf
- https://cdn.sqhk.co/wekababu/XgdhgiA/adventure_communist_rank_52.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://591379ed-26d0-4405-baa7-5b8dadede013.filesusr.com/ugd/866ffa_769c3025b4b640c1a3db2abaeebadd30.pdf?index=true
- https://80b1f93a-fe74-4439-a81d-34814fa7a505.filesusr.com/ugd/e56fe2_f466ad6c54474bc2b8018ef1d125baef.pdf?index=true
- http://goxakimolo.epizy.com/foolin_around_usher.pdf
- https://uploads.strikinglycdn.com/files/80de3b09-790c-489f-b67c-2213027061b0/how_long_do_priority_mail_take.pdf
- https://s3.amazonaws.com/wesezuzuvalirik/kozimixeferifevi.pdf
- https://d17f4099-ecc1-42b1-9c73-51521793457c.filesusr.com/ugd/4a2613_a29a9b38e85e418b8c94015a2aaf1e5b.pdf?index=true
- https://s3.amazonaws.com/zodererezuzuxi/87563269721.pdf
- https://uploads.strikinglycdn.com/files/fafee0fd-e989-4da6-b684-0f269356d142/5439694712.pdf
- https://9b08d158-0e0f-4203-9b31-e1272d977b1c.filesusr.com/ugd/086daf_4f58b8fccfa44171bef5956c22574b8f.pdf?index=true
- https://s3.amazonaws.com/gowupuzokowuxes/cuantos_litros_tiene_un_metro_cubico_de_oxigeno.pdf
- https://b24036c1-08f6-4d5b-b8c9-f4c47f26e437.filesusr.com/ugd/ae9acc_3146434317bb4dbe91ed1c4b557e2501.pdf?index=true
- https://bc260b4e-efc2-469d-9102-9c7234992d76.filesusr.com/ugd/b1b3ad_36ae209596d94f4aacac13978971907e.pdf?index=true
- https://uploads.strikinglycdn.com/files/e2381a0d-c81a-4d0c-b4af-7608738b18ee/72531949119.pdf
- https://ab25a8b3-4d80-4d4b-93a1-c1347014fa7c.filesusr.com/ugd/8d0191_26150ca6dbc444aa81643eada0d9568e.pdf?index=true
- https://828c6a01-da61-4814-986a-f72e64f4f334.filesusr.com/ugd/cdfdba_0f83628273f040739c4df3ec5f0e6271.pdf?index=true
- https://uploads.strikinglycdn.com/files/017ec2fc-0304-445f-aa58-1f89311224c9/can_you_extend_your_cdl_permit.pdf
- http://mutupoda.rf.gd/sealed_book_of_mormon.pdf
- http://baxujaxifibew.rf.gd/limadovejifenikajewufeve.pdf
- https://2978fa49-077f-489e-bef2-0e177375ffd3.filesusr.com/ugd/50ba8f_c20094393c364fb981056c640b6fc8d7.pdf?index=true
- https://e05653fc-386e-4c8b-889d-738aee72c63e.filesusr.com/ugd/62421a_6535e1f1141a45498a746c3b11c0f799.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001339e.bin84d8e82487b17c84dcebe2e93e0a5f619a701c9b6fc37754f01baa2e8b9a9fd7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1339E | 5236 bytes |
font_01_sfnt_off00014569.bin7d3f6f0cef56e33bebd549c1efde7ea2a80150cec0458aacf78341534f274f02 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14569 | 12312 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.