MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://bologen.ru/award?keyword=oxford+picture+dictionary+english+turkish+pdf PDF link annotation
- https://maxedojose.weebly.com/uploads/1/3/1/4/131452800/rodov.pdfIn PDF document text
- https://tamusibexo.weebly.com/uploads/1/3/5/9/135966636/9211256.pdfIn PDF document text
- http://susurrus.space/bejexasevixubuzamunipegux7qyhu.pdfIn PDF document text
- http://idealica-italiaufficiale.website/new_mary_poppins_movie_musicwzbob.pdfIn PDF document text
- https://mizunemaki.weebly.com/uploads/1/3/4/8/134850414/wafufevupofurelupege.pdfIn PDF document text
- http://kuxalowakanuxed.iblogger.org/87164621442.pdfIn PDF document text
- http://zelolugo.22web.org/4457674479.pdfIn PDF document text
- http://about-central.com/75313527200lulb7.pdfIn PDF document text
- http://dvigatel.guru/33616618515w8mrc.pdfIn PDF document text
- https://memumijakularaj.weebly.com/uploads/1/3/4/5/134507661/pikugixuvid_xedetasalo_rumoj.pdfIn PDF document text
- http://ideaita.fun/chocobo_colour_guide_ffxivwjub4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bulikowexunepov/singular_and_plural_nouns_worksheets_grade_1_with_pictures.pdfIn PDF document text
- http://zejowupifodoj.rf.gd/applied_finite_mathematics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/55c3a210-095d-4649-97ad-b8a88bb6d1a0/81390816775.pdfIn PDF document text
- https://s3.amazonaws.com/dojonuta/dole_bwc_able_forms.pdfIn PDF document text
- https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_42a31fe2ed8a4190a4b53cfd596cdce6.pdf?index=trueIn PDF document text
- https://7fd92c66-d3af-485c-b7a9-31529ddfb1b5.filesusr.com/ugd/997d0f_0dd09b1d316f4da8a50acc88610ba290.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/6c9f8588-3c03-49e5-9f06-1f51cecd41b5/casio_g-shock_gwg-1000-1aer.pdfIn PDF document text
- https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_ec07c7deceaa43d581619156c479d629.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/db43d73c-9d44-4656-b270-c5a94c422ec8/25563693036.pdfIn PDF document text
- https://591e60e9-54e8-4b06-a9a7-f2e0522969d0.filesusr.com/ugd/1fd4b7_bbb3b339666e4ab082c9d36f0f3173e6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0c4abf3c-20c1-4f7c-a830-a12526831be9/95701352661.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a4358594-3f93-424a-84f5-259528d73d93/best_free_star_map_app.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d76d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD76D | 5676 bytes |
SHA-256: 6497d64759ded012b952b5d94a6f78f4c3efac1adfafc7b469d8a82012a0ca20 |
|||
font_01_sfnt_off0000eac6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAC6 | 10572 bytes |
SHA-256: 2f4d5f7d3a0c827e6d11b011ae14e4ff1793f6e3f6d16641894381bd5952b9c4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.