MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was flagged by multiple heuristics, including a critical finding for a PDF link farm containing numerous external links. The primary malicious URL identified is 'https://bologen.ru/award?keyword=benyamin+goat+days+pdf', which is likely part of a phishing or SEO scam. The presence of many external links suggests an attempt to drive traffic to potentially malicious or deceptive content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9946
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=benyamin+goat+days+pdf
- http://perexifolelave.iblogger.org/wonibavevupugipufar.pdf
- http://tiwelonepozafuw.iblogger.org/canada_fuel_consumption_guide_2018.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102Hussain
- http://smc.org.inhttp://smc.org.in
- http://www.opentle.org
- http://fedorahosted.org/lohit
- https://uploads.strikinglycdn.com/files/8dfc5ccc-94bb-4e00-b2de-6c55e4b1aab0/zusutotibuzibipolitivamol.pdf
- http://metusajixano.epizy.com/booster_software_for_pc.pdf
- http://forawoxo.epizy.com/54227946986.pdf
- https://uploads.strikinglycdn.com/files/67c4dbaf-ae0b-49f4-9799-6cd4b639bc2f/nordictrack_a2550_weight_limit.pdf
- https://71bfc0c6-4bef-405a-aee6-9e9dcaab3d12.filesusr.com/ugd/708cfd_71974a6edfd54ab9a7817a4f254475d8.pdf?index=true
- https://s3.amazonaws.com/vavejijitatofu/18774190819.pdf
- https://s3.amazonaws.com/lorerexeg/vagidexax.pdf
- https://abee6ad4-cf47-459a-954e-22b9b9bb30ad.filesusr.com/ugd/4bdc6d_39d9a796b1c24531a828da340130c1ed.pdf?index=true
- https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_2c17beb43069450caf5381740568457a.pdf?index=true
- https://uploads.strikinglycdn.com/files/f43397e3-037f-4e7f-b301-c5c473d6328f/24330734730.pdf
- https://bd7a0a6f-bbfd-49cc-ba41-c3f2778102d9.filesusr.com/ugd/9ea91e_d6290e60829648bf9d9b7c862b0c7609.pdf?index=true
- https://36622f5a-5a1b-41a5-aa98-965156e47ac2.filesusr.com/ugd/804ff6_d4945ed2fb544da9b7edad2dce05a5df.pdf?index=true
- https://19aaccd0-9772-41b6-85c4-be118606641a.filesusr.com/ugd/a12125_303b0393dc144779b0d9396d73364331.pdf?index=true
- https://uploads.strikinglycdn.com/files/3eda4b6e-0ce0-445b-9a1f-0f4d8389d16b/arturia_beatstep_pro_black.pdf
- https://uploads.strikinglycdn.com/files/b6c28392-0c77-4d64-99a9-2ffa19c185d0/40_rules_of_love_review.pdf
- https://d5bea983-5bca-41ba-aae6-6b688785cc77.filesusr.com/ugd/9ec29b_63a9eadc0fd649a8819739a40f57cb9d.pdf?index=true
- https://s3.amazonaws.com/luropi/bouncer_11_apk.pdf
- https://uploads.strikinglycdn.com/files/78faabc4-1eeb-4192-b700-410546fa081c/gomotara.pdf
- https://uploads.strikinglycdn.com/files/d9145641-dff3-42fa-8980-1e01d018986f/vajoxilujug.pdf
- https://5457524e-bace-410a-9ce7-c8d8bc0eedea.filesusr.com/ugd/f0ffd0_700a784c2eb04cf2bf8d0cd4a2eb1190.pdf?index=true
- http://mibiravotawuga.epizy.com/totov.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- https://gitlab.com/smc/meera/blob/master/COPYING
- http://www.gnu.org/licenses/gpl.html
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 7
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f837.binbbb5e0a7f7bff067d06f98ee075e792b0096d179501d3addf5206a58b4296cce |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF837 | 5384 bytes |
font_01_sfnt_off00010a82.bin44971535f5acb815164b44e4a84a00d9b5361b5fcc4b44b0097be3bc33f68b97 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A82 | 6128 bytes |
font_02_sfnt_off000120de.bin98fa5597d02f8a2228092700797a32861952a61c51eb7faeed05167fd73da6df |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120DE | 7256 bytes |
font_03_sfnt_off00013440.bin3e440e9adb97cac7b4aaf93f8c9a605287c54f503b9c205c4270f0b4dcbd8c04 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13440 | 11964 bytes |
font_04_sfnt_off00015c20.bin6e1b161e226bd39d7ebc36bf5d28f1d9fc6dda429f7574896d5e9f88e5efb0aa |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15C20 | 16896 bytes |
font_05_sfnt_off00017481.bincf2113aeaefce02119725524767c424f6db52020c08ab9761d3cc25d87160ef8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17481 | 2848 bytes |
font_06_sfnt_off00018012.binb13c4a478016ee91ede09a7d2f1096952a0fda55c854ce68974cbbb6a7c74f49 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18012 | 4272 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.