MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9951
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=what+food+should+be+avoided+in+high+bp PDF link annotation
- https://cdn-cms.f-static.net/uploads/4417527/normal_60561905ec563.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4471082/normal_604180d31fd50.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4415326/normal_600039c371562.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://f43304fd-85e4-489a-8612-81977e01be4a.filesusr.com/ugd/b6f504_cc2c7a9309af4c9e9b309c054ec6e63e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/votawawo/thimiru_pudichavan_bgm_ringtone.pdfIn PDF document text
- https://s3.amazonaws.com/fosalizuzu/nezupujiwalejapasusida.pdfIn PDF document text
- https://s3.amazonaws.com/bexolamabad/63927436045.pdfIn PDF document text
- https://s3.amazonaws.com/wavunot/bhandara_district_information_in_marathi.pdfIn PDF document text
- https://s3.amazonaws.com/vovuzize/used_ford_escape_hybrid_for_sale_by_owner.pdfIn PDF document text
- https://203e60c5-e32a-4587-ab6d-31d66de6d5b9.filesusr.com/ugd/014c36_4005b799bf1b4bf798007402dcbe8d06.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/sefepugolupalax/1351079247.pdfIn PDF document text
- https://dacf5b84-f80e-4bd8-bb7f-22aad20a1cd8.filesusr.com/ugd/285be4_b8f0aa8e79ee459cb576cff9bcad27f6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2d1b9387-db2e-4754-90ec-d636652d1d12/bushnell_golf_watch_reviews.pdfIn PDF document text
- https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_32b73f935b1942578bd3075a747a771a.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8178297a-34ee-41e0-8edd-4202a1c821ef/rubir.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/470ce02b-55d6-497a-a633-0a0e0d0aa5fe/object_oriented_programming_concepts_in_urdu.pdfIn PDF document text
- https://s3.amazonaws.com/fisulefajow/adobe_acrobat_professional_11_trial.pdfIn PDF document text
- https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_f850e979cd1a477095e2f9e697452996.pdf?index=trueIn PDF document text
- https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_19156dc8f92440b094768a8f7cf8a27e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/punurum/69057399792.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f8fd2167-10dd-40a0-9b28-014741159ec7/what_are_the_4_personality_theories.pdfIn PDF document text
- https://s3.amazonaws.com/purawuma/89750485717.pdfIn PDF document text
- https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_cd091ec414ac4a6f9a9d82f92395d9b9.pdf?index=trueIn PDF document text
- https://d3919fa5-c020-464c-a773-72e456e10464.filesusr.com/ugd/29136f_031014405f5244c6a1aea3c9d0cddf41.pdf?index=trueIn PDF document text
- https://30f21d72-2b41-4965-a7bc-2abb02bf1ded.filesusr.com/ugd/47e66e_c859e274dd864cb18bb6704c0cae2c43.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/753f6a00-9eb1-4e60-bbf9-04e3713efaf0/daniel_fast_vs_plant_based_diet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off000133e2.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x133E2 | 17756 bytes |
SHA-256: 9d7b7f7f03266e827e526b9e83a9c003b408d8af68cde7d4c621ade82359ffb5 |
|||
font_00_sfnt_off0000fb98.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB98 | 5420 bytes |
SHA-256: 49b2e0c337158902d4397932d8403d940407bdf91c8500d810ea06b9e8525b33 |
|||
font_01_sfnt_off00010e1f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E1F | 11016 bytes |
SHA-256: 543da1e3a924e2aa7aee0bf8b32fe18bc9cc981f7367b4bd8575fb161f192dd5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.