MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous embedded URLs, with a significant portion pointing to disposable hosting and potentially malicious domains. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a link farm strategy, and the ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a phishing or malware distribution attempt, likely initiated via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9961
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=who+runs+the+anarchist+library PDF link annotation
- http://godezigupo.mywebcommunity.org/biblia_reina_valera_2020.pdfIn PDF document text
- https://cdn.sqhk.co/sajixobuko/m9jjRx3/fuvidadujavewobanesage.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486354/normal_5ff9bedd99565.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379844/normal_606022832dac3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4428329/normal_600935a6b37cc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413719/normal_6037525e95d1c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403414/normal_5fe8ec5442c10.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421464/normal_5fcfa1852c551.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366009/normal_60693a5ea04c3.pdfIn PDF document text
- http://lipexifinidoda.scienceontheweb.net/zaweridumajatamusomobonid.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450249/normal_6038247c5395e.pdfIn PDF document text
- https://cdn.sqhk.co/sevijeruba/mhj71xI/23396461234.pdfIn PDF document text
- https://cdn.sqhk.co/rekutadis/tichbIk/winamp_mp3_player_free_download_for_windows_10.pdfIn PDF document text
- http://gusevoxuzuwelap.mywebcommunity.org/tijijedesa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4410703/normal_5fe2790048d87.pdfIn PDF document text
- http://rijoginijamibeg.mypressonline.com/gurazogevuwi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4479223/normal_60697f661d4c9.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f68a92cc-6898-4521-a304-32a56d4fd10d/how_to_update_garmin_nuvi_1490_maps_for_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bced6d7f-d4e5-485d-bb32-fc6c7eb3227f/which_wireless_dog_fence_is_best.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/13e858af-9a91-4126-bdec-bb44d0a93a24/html_tags_and_definition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9143029a-6bc1-457e-827a-f7fd2392e4c3/remington_700_short_action_308_barrel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f327e482-72a5-4830-a053-cdbf72b58da9/9896184030.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/65d7a6f6-1269-4bbe-8f4e-bbf076beaf48/didepamejidon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a01f3b0-ec0c-4f11-817b-9da96fbca446/point_stuart_wilderness_lodge_reviews.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/074187cd-2e6e-45cc-bf0b-f5a5279533f2/71436846344.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1d8a0a30-2308-4d4c-b130-5780856c16e3/45289857618.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f224.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF224 | 5144 bytes |
SHA-256: fa153273aae21b898c9857a4be91782ed44097fd784be41414a6dd4eb4ba5d60 |
|||
font_01_sfnt_off000103ac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103AC | 11772 bytes |
SHA-256: 0227f73f87ea65c6c3f207a356101df2cbd6941ad26578f39069bd1d410f7725 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.