MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, suggesting it functions as a link farm or a distribution point for further malicious content. The document body, though heavily obfuscated, contains references to '12 steps of legislative process' and 'wkhtmltopdf', likely a lure to disguise the malicious intent. No scripts were extracted, but the extensive link farm points to a high likelihood of redirecting users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9950
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/strik?utm_term=12+steps+of+legislative+process
- https://cdn.sqhk.co/sevafeluba/hbiiWPj/33681413300.pdf
- https://cdn.sqhk.co/rarinuva/cnifhi4/98955330761.pdf
- https://cdn.sqhk.co/ramojezi/Dhihgij/glass_break_wallpaper_hd.pdf
- http://rixorevu.getenjoyment.net/cambridge_ielts_6_reading_test_1.pdf
- https://cdn.sqhk.co/nogorodizet/d1jargn/dobagovuvuzozubenik.pdf
- http://sizegoduxuxa.mygamesonline.org/bombas_de_ariete_hidraulico.pdf
- https://cdn.sqhk.co/kawurefeki/NEC4iib/minecraft_new_ore_2020.pdf
- https://cdn.sqhk.co/dibirolinu/BshjigQ/18630127282.pdf
- https://cdn.sqhk.co/bisadumiza/RExijje/72275008700.pdf
- https://cdn.sqhk.co/sixitigoxeto/aoVjgQt/zixomokereganivoke.pdf
- https://cdn.sqhk.co/mupijuwo/1ijfNhc/samunufox.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/258e8c24-edf9-425f-9286-597f30fb43fd/gamemaker_studio_2_vs_construct_3.pdf
- https://uploads.strikinglycdn.com/files/7e277c68-f816-4c92-8f84-db70f2719d7a/harry_potter_game_free_download_for_windows_7.pdf
- https://uploads.strikinglycdn.com/files/dfa2ec18-fc96-493e-a80a-c7c29b17ab55/how_to_use_nesco_dehydrator.pdf
- https://9505ca4c-dfdc-4941-8fde-ded35496d0c9.filesusr.com/ugd/2097ab_73b11ebe24484d7f80164ff098374865.pdf?index=true
- https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_b241f29da86a4789ad55bf8bcd6bcfc1.pdf?index=true
- http://xotaferuju.myartsonline.com/41343897207.pdf
- https://uploads.strikinglycdn.com/files/828e7103-5c28-4d75-ba12-7ca968b25c0a/chords_for_have_yourself_a_merry_little_christmas_piano.pdf
- https://43081b45-6e48-4b43-b724-9328fda377ae.filesusr.com/ugd/26481d_0f14c94c240e47f495c5bb0eca280938.pdf?index=true
- http://fadudenomo.onlinewebshop.net/astronomy_for_dummies_free_download.pdf
- https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_6604969162d74caa80e8cea69104994f.pdf?index=true
- https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_e41ca65548ed4bbd927c7586bb1803a8.pdf?index=true
- https://000bb656-a8cb-4e8b-9327-0b0ec99f56fe.filesusr.com/ugd/3f812e_8788118113ea4d05b88ae3a85cc79cba.pdf?index=true
- https://7404da97-7fcf-4d5f-9d5f-3f8644e6773a.filesusr.com/ugd/35f767_283efac7743944869343085549432ee7.pdf?index=true
- https://d6236f05-450e-4b96-9875-1783d83c708b.filesusr.com/ugd/912de2_de0f9117ac64496eb5f2312c7c3411e4.pdf?index=true
- https://e942959e-95af-4115-ab05-a6e38533eaad.filesusr.com/ugd/66f7a0_199d4c44a2df439d9f567ed8da4ff151.pdf?index=true
- https://uploads.strikinglycdn.com/files/2b9ceb88-7e8c-47b0-a322-9caaaea141b6/love_poems_for_husband_from_wife.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f0a9.bin165cf5a23596d843ee4a000bb57be8b7293a9532f1ddcb3d7ca413eeb1c3ac08 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0A9 | 5332 bytes |
font_01_sfnt_off000102f2.bin80ba5d9fd2ca04a6a062c8410eeb44566c63e4958fc33bac8d33969bc0708a7c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102F2 | 11236 bytes |
font_02_sfnt_off000129cc.bin598cc59b469469676cd09940ab324f140a6c2073da5e37e8a017debe1138acf5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x129CC | 17976 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.