MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The sample is a PDF file identified as malicious by ML classifiers and ClamAV. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO manipulation tactic. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a potential for directing users to malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/award?keyword=ncert+biology+class+12+pdf+in+english PDF link annotation
- https://potisejomi.weebly.com/uploads/1/3/6/0/136092970/nijibedewofodop.pdfIn PDF document text
- http://detonic-de.website/41599763880lfd9r.pdfIn PDF document text
- http://ravevuzovije.mywebcommunity.org/63955312995.pdfIn PDF document text
- http://wivaserana.mywebcommunity.org/a_que_se_debe_el_dolor_en_la_espalda.pdfIn PDF document text
- https://kexejimeso.weebly.com/uploads/1/3/4/0/134096016/jelolikemonoveban.pdfIn PDF document text
- http://crawlmqyu.space/conditional_statement_worksheet_with_answersvf0is.pdfIn PDF document text
- https://kemovovem.weebly.com/uploads/1/3/1/4/131408999/23593.pdfIn PDF document text
- https://gavofazipog.weebly.com/uploads/1/3/3/9/133999173/a3c3a20106be.pdfIn PDF document text
- https://lebilelumebik.weebly.com/uploads/1/3/1/6/131636833/5a17937.pdfIn PDF document text
- http://ladebizelase.scienceontheweb.net/40704480597.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/764f5701-ab0d-4789-92a6-44f5af0e893d/vizio_e231-b1_remote_code.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d7d9e3a3-d33b-4d8e-bfd9-8f383381a81f/pedeti.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b12f520e-75db-4d1c-9ac6-0497cd93f78e/gegufaka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3bc5ea4-e3ee-4999-9650-7d57cd553854/bertrand_russell_quotes_fools_and_fanatics.pdfIn PDF document text
- https://ff999131-262c-4f46-aa1e-84c50d3d9e43.filesusr.com/ugd/a474dd_bfdf1383fb0046e4b631462c906a0b25.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/badc6618-439a-48fc-9a5f-293a1e9c4fa6/bram_stokers_dracula_cast_of_characters.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a40cb714-82d4-4bb3-96e0-2e999acf4dd5/39611868880.pdfIn PDF document text
- https://2dc0326d-ac60-47d8-bf46-f2dc9d334570.filesusr.com/ugd/21b4a7_b1d45e3f36ff4566a3a39e51dab251a0.pdf?index=trueIn PDF document text
- http://sabiwilurase.atwebpages.com/ancient_civilizations_map_activity.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/43ec9073-afe2-4eb9-b562-d309cd35f8bf/samsung_galaxy_tab_a_8.0_t350_book_cover_case.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3d0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3D0 | 5812 bytes |
SHA-256: 2ad82445f3f29348360232e48818b3fcb0105f819d594559e28ebb9d63dcf65b |
|||
font_01_sfnt_off000107a5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107A5 | 10896 bytes |
SHA-256: cdde74090d6a93df686f2c2a0d015ec0225d7be4321c35b81d67b57df8158235 |
|||
font_02_sfnt_off00012cf1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CF1 | 16096 bytes |
SHA-256: 4a4ba2916cbb77a4560e469f3199d6e84ec5cea7a529ccdf4999d6eae28de042 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.