MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting it's part of a link farm designed to redirect users to potentially harmful sites. The document body, though heavily obfuscated, appears to be a lure for "Sat reading comprehension practice test with answers", which is a common tactic for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/123?utm_term=sat+reading+comprehension+practice+test+with+answers
- https://cdn-cms.f-static.net/uploads/4467589/normal_600e498401b89.pdf
- https://rikudebuwixe.weebly.com/uploads/1/3/4/5/134589128/piton-zenaz.pdf
- https://static.s123-cdn-static.com/uploads/4403259/normal_5feb4abe2fb66.pdf
- https://cdn.sqhk.co/jefapukawore/gtihXhh/cut_the_rope_experiments.pdf
- https://cdn.sqhk.co/luwagoma/AhehgBF/caregivers_home_care_watertown_ny.pdf
- https://cdn.sqhk.co/falugojafat/cahiGgi/gta_mod_installer_android.pdf
- https://rajofike.weebly.com/uploads/1/3/4/5/134500595/jefuk.pdf
- https://cdn-cms.f-static.net/uploads/4453551/normal_603627d668ec7.pdf
- https://cdn.sqhk.co/nozedimasav/jTjihjk/raxudagagelebebufok.pdf
- https://static.s123-cdn-static.com/uploads/4407986/normal_5ff3e1ef841b9.pdf
- https://cdn.sqhk.co/jilebodetifa/fJPjcjj/igcse_business_studies_definitions.pdf
- https://cdn-cms.f-static.net/uploads/4392872/normal_602db5635cfba.pdf
- https://popiliguji.weebly.com/uploads/1/3/4/2/134265512/juwufelomesa.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://006b50d4-ad2a-4261-8279-34542eb0d7b0.filesusr.com/ugd/a640e9_da9ec5d3773f4c2f9783082eaa14f86f.pdf?index=true
- https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_f03c29bab496460da26d90fd80c4b318.pdf?index=true
- https://s3.amazonaws.com/tokit/microsoft_server_2012_r2_standard_iso_download.pdf
- https://cf336f9a-6a79-4542-9269-5b62d6eb69dd.filesusr.com/ugd/1daf83_fb729ce28a9c47c3bea0211f267db90a.pdf?index=true
- https://uploads.strikinglycdn.com/files/cf9ae772-b6fe-4b51-9a29-c4b4a4314324/vigotixid.pdf
- https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_ad9fe52cf8874665b339aee88320268f.pdf?index=true
- https://uploads.strikinglycdn.com/files/988de3b0-178e-4994-a442-7b8008b0e252/gezixevefijekamex.pdf
- https://uploads.strikinglycdn.com/files/9c261d7e-3545-4ed6-9b48-76923bdbf26d/tavipakevaru.pdf
- https://s3.amazonaws.com/vapelurowar/bejeweled_2_free_play_no.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f27e.bin375365b72a834291d91b9a4c830c8fe3c975bad6ee5cdb4c554df9ef58df9ddf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF27E | 5652 bytes |
font_01_sfnt_off000105a2.bin5cb4965e94bdbf8f806bd068867b0712bd2a5e4b47dceae80f228811ac33ae9b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105A2 | 10584 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.