MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a large number of external links, many of which point to disposable hosting and are used for SEO manipulation, indicating a phishing or malicious redirection attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution via these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/123?utm_term=lines+of+latitude+and+longitude+map+worksheet PDF link annotation
- https://cdn-cms.f-static.net/uploads/4370088/normal_601d3d628eb74.pdfIn PDF document text
- http://tovarzone.ru/22754741875d6ecc.pdfIn PDF document text
- http://fimewot.xyz/cisco_re1000_setup_cdhh8kw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4499629/normal_603fb23c82154.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380214/normal_5fd1366eaa451.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495691/normal_6047bec569cca.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462982/normal_5fe961c15ec65.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366989/normal_5ffc91006f3e3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462980/normal_604975f63d373.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464311/normal_5ff8fd2f6cf5c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4462350/normal_600d78e5ab1ab.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4dfaa2bc-726f-48c3-8e76-83ca46abc852/what_are_the_8_basic_knots.pdfIn PDF document text
- https://51da6a7d-ee05-4a49-87ee-1b74af3aeb07.filesusr.com/ugd/b80405_d0c2ab0d901844fba616409e1124ec0f.pdf?index=trueIn PDF document text
- https://3b0fe5ff-7f86-489c-8138-fc984e51136c.filesusr.com/ugd/bfd78a_49fec88b5577439c9c6fc71754fbbc63.pdf?index=trueIn PDF document text
- https://e082cb0d-9c22-4a21-acb7-e2c6127a51d3.filesusr.com/ugd/ff0c06_dc72b0fbe7e74a62b56af35a7110fd2f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6ab76436-6297-4536-a09f-30896d313bda/videos_de_verbos_en_ingles_y_espaol_para_nios.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b314339d-ce63-4555-bd66-eb9b4a1108ed/66349747906.pdfIn PDF document text
- https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_2752c71966c44e3e933198574fea0db7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/f9e53182-2c21-4c7b-9e17-58782f8650a5/ninjago_season_11_episode_16.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93477869-ff34-4100-a860-71968469be1d/20996921246.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDBA | 5552 bytes |
SHA-256: c1f689ed89d389da17499365d43f4ca371017d3b9f114ae4a6662808b41b2d62 |
|||
font_01_sfnt_off0001008b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1008B | 10996 bytes |
SHA-256: e4d0e4e7cefa81d54cf20e918b848a99db536315bed6c235c03b18fd5f668f60 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.