MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=how+to+cook+a+spiral+ham+in+an+oven+bag PDF link annotation
- https://vemusosafuz.weebly.com/uploads/1/3/1/3/131398108/degal.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381321/normal_606a8ce2e8442.pdfIn PDF document text
- http://daating19.site/how_long_do_you_cook_turkey_burgers_on_george_foreman_grillkv9gn.pdfIn PDF document text
- https://jigaxokere.weebly.com/uploads/1/3/4/6/134622899/2614696.pdfIn PDF document text
- http://semengergel.ru/pets_mod_for_minecraft_pe_lucky_blockg503b.pdfIn PDF document text
- http://smilex.club/59999973460hmjli.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4391642/normal_600967f7bae44.pdfIn PDF document text
- http://sushibara.net/colorectal_cancer_prevention_guidelinesqhgun.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422377/normal_603b16e46e1b7.pdfIn PDF document text
- http://imedo.ru/katemalawikuvijedexogugkp6og.pdfIn PDF document text
- https://nabesoke.weebly.com/uploads/1/3/4/0/134042749/vigivovizuga.pdfIn PDF document text
- https://sasenepekevob.weebly.com/uploads/1/3/4/2/134266747/4ba98d5122a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415930/normal_60337180d7eaa.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/e0206859-4cc0-49c1-bc33-97c1a63f0376/sony_wh-1000xm2_manual_svenska.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/048ed908-8d47-4082-9eff-aee3b9d6f1bd/pexibaxakixoremuno.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/930d77b2-ff3b-4512-b406-2cb7e77aa3c1/4740436866.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38d3b6e7-fbbb-49cc-a0c4-cfe2c701ff33/how_to_record_fob_shipping_point.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3162413-7ba4-45d7-a79e-7097ba8c4bb3/gidamixafudafaselirexun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0a8858fb-eb09-412a-b4e2-e0afb46d9ac0/43848178437.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5f4b0c2-5e0d-4ae9-a5ee-7e35ad792875/75944835015.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/258fb457-f8f6-4bdc-9d1e-20de61a8c118/how_to_set_time_on_tissot_touch.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/23766006-4d61-418a-9d37-cb938f7f1c44/zereretux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/680bc222-a4b0-4002-b673-265f3b985b43/16152185172.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/20662d75-b752-4385-9152-8a161ed444a9/kuwurexuxofuso.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73de0d0e-b244-4011-a1ec-afb375958d41/is_adobe_premiere_pro_free_for_windows.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa27.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA27 | 5664 bytes |
SHA-256: 48ef0eabd343c58e248e130a6a7467498475ba2b82628b416e52abf899cd3112 |
|||
font_01_sfnt_off00010d5a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D5A | 10396 bytes |
SHA-256: 2103d625bf2847f9b21a4ca4879e2e3adbf0ccc493edebc6396a56f342af7676 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.