MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many of which point to other PDF files, suggesting a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier indicate malicious content, specifically identified as a phishing trojan. The embedded URL and the document body's deceptive title suggest a phishing attempt to trick users into downloading further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.5384
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/award?keyword=asmaul+husna+dan+artinya+lengkap+99+pdf+download PDF link annotation
- https://cdn.sqhk.co/litopozuf/Uihjbjc/jack_adventure_2_platform_jump_run_fighter.pdfIn PDF document text
- https://zanazajerepa.weebly.com/uploads/1/3/4/0/134012527/6522997.pdfIn PDF document text
- https://lovebaxubifutu.weebly.com/uploads/1/3/4/3/134322000/bugow.pdfIn PDF document text
- https://cdn.sqhk.co/raninogozo/cdTnie8/luminocity_festival_2020_new_york.pdfIn PDF document text
- https://cdn.sqhk.co/modajili/giiFjgK/chemistry_books_free_for_iit_jee.pdfIn PDF document text
- https://cdn.sqhk.co/bitizulokiva/bgjzgcA/arcade_fighting_games_play_online.pdfIn PDF document text
- https://barosowuni.weebly.com/uploads/1/3/1/3/131398377/riputazipesukogugof.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a8ebc380-431a-46ac-9a8d-d008c96f8a65/bayliner_service_near_me.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be0691c3-c14f-4ab3-8101-88799c1374d1/balid.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28ed5f34-4230-4633-96b7-81fad66614a6/kenmore_accela_wash_clean_washer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3a517307-9b2c-48d7-b697-fa84fb47e315/27679831577.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7de3d64-e0b1-4c4a-971d-d6f2f10e1904/left_behind_series_book_3.pdfIn PDF document text
- https://s3.amazonaws.com/zafijukopa/62598555562.pdfIn PDF document text
- https://s3.amazonaws.com/rokuwapesu/79153087178.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f28591ab-4fe4-4953-99c5-8289d8550430/how_do_i_reset_my_moen_garbage_disposal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d0531685-a968-479f-801a-bbd1df24ade9/tatizivajeliz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5de8ef5-c86a-4ff1-8b75-f8ec2ed3a35b/hayward_sp3400vsp_ecostar_vs_variable-speed_pool_pump_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57fed938-cbec-4150-9971-9a6f3052942c/principal_data_scientist_salary_nyc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9146e04c-6bde-48d8-85b7-26f700dd97f4/27313319104.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/038ce252-c56c-4543-be64-95a613c7176f/factory_reset_dlink_dir-890l.pdfIn PDF document text
- https://s3.amazonaws.com/suzujewa/luther_season_6_episode_guide.pdfIn PDF document text
- https://s3.amazonaws.com/fuzafuzeruwit/11529897670.pdfIn PDF document text
- https://s3.amazonaws.com/bopuxosavubare/scoreboard_template_css.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010c59.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C59 | 5860 bytes |
SHA-256: d3d214fe60eac9263681b203c064acfb21f5dcea71c520773636c959c0d9e6f3 |
|||
font_01_sfnt_off00012030.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12030 | 10816 bytes |
SHA-256: 50ea9ac42258a5e000ba40b3ae14b3e67ff6c0dd7ccf0ab7ff77c948e9c58fa2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.