MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/strik?utm_term=how+to+hard+reset+a+honeywell+thermostat PDF link annotation
- http://nevepojikita.22web.org/90800038015.pdfIn PDF document text
- http://tigesonepovar.66ghz.com/66951878033.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/720c7ba1-3bed-4117-876a-68262c4e1f91/super_champ_x2_head_vs_combo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ecf26b3f-1976-4e9b-9ef6-26d28fc0b491/how_to_unlock_alcatel_lucent_phone.pdfIn PDF document text
- http://rumakepalo.rf.gd/wuxinebezul.pdfIn PDF document text
- https://s3.amazonaws.com/vasofirida/maniac_2012_mp4_movie.pdfIn PDF document text
- http://gutezapirasawad.rf.gd/pujanufapaxevogabojeni.pdfIn PDF document text
- https://2ea9429b-0332-4ee6-bb75-ab9535b56c99.filesusr.com/ugd/e2f7e1_c5d206d48d8b47ba8b9298aab06bd18d.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/jivagajamav/the_road_not_taken_summary_and_analysis.pdfIn PDF document text
- https://1b3e2d6a-0348-4772-9bb2-16e56a761455.filesusr.com/ugd/7bcf02_32a77860c78a4bb2a9d6b67edecf8848.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fc5b2734-3e5c-4841-ab72-fcb5051d55ec/wapexafuzo.pdfIn PDF document text
- https://s3.amazonaws.com/mibiwivanetuj/63875101863.pdfIn PDF document text
- https://62619d47-812b-4c4f-a232-aa08d86264e8.filesusr.com/ugd/6d62c1_dc4ee4a3695f4c1699b73972aa3df668.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gozifep/51073354848.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/42eacc4a-cfa1-4b5f-967d-5359c2e0ba44/lactancia_materna_oms_unicef.pdfIn PDF document text
- https://s3.amazonaws.com/fatikonavori/javakigav.pdfIn PDF document text
- https://8ed6bd9f-de2b-4923-b7df-82f95eb18a03.filesusr.com/ugd/7fa32f_59d565900c7b4604acdecc25ddd0684f.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nefunupu/criminal_justice_reform_bill_definition.pdfIn PDF document text
- https://17851959-1482-4b49-8222-7b7b0c628459.filesusr.com/ugd/3cb679_5844fe5f349c49e9a17aa9cca86df2e9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6d094658-1c5a-4c92-bd28-49c11540832d/tree_of_life_nursery_availability.pdfIn PDF document text
- https://s3.amazonaws.com/megujobemegor/casio_g-shock_ga-110gb-1aer_cena.pdfIn PDF document text
- https://s3.amazonaws.com/fotojipifuzitul/6932239362.pdfIn PDF document text
- http://pajoxewujovero.rf.gd/suregokogusaforile.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7d967847-db0d-439e-bf2c-bdb7eaa4e62f/nibum.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d9144fd-a461-4062-8d53-250d6cf936a4/lutozi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa9a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA9A | 5220 bytes |
SHA-256: 402e03a2b2d40b0aa74df5896b4aa524179b6723cdd15eb81440c4a7118e0bd5 |
|||
font_01_sfnt_off00010c40.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C40 | 10676 bytes |
SHA-256: 3ff044959ee5beff68227be5818b3df54cc0bb2e3f3c1713be923cc57b0f8980 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.