MALICIOUS
226
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a password-protected-archive lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/aws?utm_term=a+lesson+before+dying+discussion+questions+by+chapter PDF link annotation
- https://cdn.sqhk.co/posiraki/MSAciaQ/consumer_reports_free_login_and_password.pdfIn PDF document text
- https://misapunuzure.weebly.com/uploads/1/3/1/6/131606411/6701958.pdfIn PDF document text
- https://davabodijesofid.weebly.com/uploads/1/3/4/4/134474123/e34c4c9f151.pdfIn PDF document text
- https://cdn.sqhk.co/zogowefu/ggcTX5U/23698931906.pdfIn PDF document text
- https://welafunugor.weebly.com/uploads/1/3/5/3/135327357/027afb.pdfIn PDF document text
- https://cdn.sqhk.co/rirexiwudag/D3hgija/infection_in_bloodstream.pdfIn PDF document text
- https://dodezugufiz.weebly.com/uploads/1/3/5/3/135331092/kasopevuwogov.pdfIn PDF document text
- https://vexibalob.weebly.com/uploads/1/3/4/8/134896466/5408999.pdfIn PDF document text
- https://gamiwejejorar.weebly.com/uploads/1/3/4/4/134498461/e7b49e284dd625.pdfIn PDF document text
- https://wugoxuvalego.weebly.com/uploads/1/3/4/0/134017666/zudubofofewisa.pdfIn PDF document text
- https://vonenefanor.weebly.com/uploads/1/3/4/6/134638091/801766.pdfIn PDF document text
- https://cdn.sqhk.co/rufopunuk/icOhhhu/8368416512.pdfIn PDF document text
- https://viwajojavejad.weebly.com/uploads/1/3/1/8/131858172/mapexilatixibomamuko.pdfIn PDF document text
- https://fafefojesuvun.weebly.com/uploads/1/3/4/6/134651362/xesugowosexo-duxed.pdfIn PDF document text
- https://wisenuru.weebly.com/uploads/1/3/1/8/131856959/9117136.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_ab3986c35f2b4a4b9eadbda0be9726ea.pdf?index=trueIn PDF document text
- https://77a48bbd-706a-45f8-a225-ac1cc02029d7.filesusr.com/ugd/3be48b_4d4508413bd74a2594a8a590f3664ba0.pdf?index=trueIn PDF document text
- https://bd5e8a39-7345-4d1c-b933-e8ec171ec4b0.filesusr.com/ugd/2dab9e_dc59ba1fb55a4f0ca102c305ce3bd58d.pdf?index=trueIn PDF document text
- https://5e7fdb44-65a6-4d88-9b36-b69c04d36e08.filesusr.com/ugd/b547b4_55e3ded927dc4138ba06d50c28d20593.pdf?index=trueIn PDF document text
- https://99f4a897-b223-4833-863a-50ad465ba5d5.filesusr.com/ugd/8e2371_07f7725ec959459b8fc61a6dbf9a9053.pdf?index=trueIn PDF document text
- https://ed4d48c2-14ea-47f5-a89a-b82193587323.filesusr.com/ugd/8ce377_e817d75b91db4c30ac0b95599b736cf2.pdf?index=trueIn PDF document text
- https://6d251753-49d0-4f5b-a278-10ed1cacc9d0.filesusr.com/ugd/5c139a_86263bdc085c48f78a9a73c0c1558df4.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f341.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF341 | 5772 bytes |
SHA-256: a428e07783eb49682df8e7af6f08ba6e3d2d86e177763c20354b2611242cdce8 |
|||
font_01_sfnt_off000106e7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106E7 | 10504 bytes |
SHA-256: 7125a6b94b21e550a8a2fd68a6e8150295222237d70fb6210382be8b38993d41 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.