MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=how+to+replace+bose+soundlink+ear+pads PDF link annotation
- https://cdn.sqhk.co/devuzemalut/eheiehe/910587396.pdfIn PDF document text
- http://bloodcraft.online/vojamerowumimeguzikutelxjkuu.pdfIn PDF document text
- https://cdn.sqhk.co/mobobelelu/6Kfjjin/tigosebamag.pdfIn PDF document text
- http://sfhgfje5df.xyz/john_deere_540b_skidder_specsb9e0t.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374185/normal_6033bf1d639b3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384304/normal_6035a604cf8f7.pdfIn PDF document text
- https://cdn.sqhk.co/dijowasedop/Oiajdsv/m._cblive._tv_gogo_live.pdfIn PDF document text
- http://extraevents.ru/tolefinaregatitudopudiv8icih.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4390095/normal_6065cabb2308a.pdfIn PDF document text
- http://evakuator-uga.ru/achilles_tendinitisevfy7.pdfIn PDF document text
- http://cmbespaceclient.xyz/92549541722sgdnq.pdfIn PDF document text
- http://amst-watch-v2.club/the_sinner_horror_pc_game_downloadktcz2.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4456687/normal_5ff828662d471.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460263/normal_5ffad5557de72.pdfIn PDF document text
- http://phtech.site/sony_xplod_600_watt_amp_wiring_diagramljc1g.pdfIn PDF document text
- https://cdn.sqhk.co/virurewev/b5iaSWg/printer_3d_terbaik.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/dddf3776-4feb-43b2-b6dc-7b09ebe390b7/does_vizio_m55-c2_have_smartcast.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7058f5a-01ba-403e-a39a-34934d314b35/gardens_of_the_moon_review_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac5a81a0-32e2-433b-abbb-c1615828bdc4/davinci_resolve_15_tutorial_color_grading_crash_course.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/acc6f685-f7cb-4a02-b132-f2a13eed9ee3/diretomufatanenolegapux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f8befed-de36-4a97-b9ee-77df0fc741c3/28050682701.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/313ec9df-048c-4cd7-8e2a-195fa0fccdbf/modo_de_produccion_capitalista_origen_y_desarrollo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e079638d-e82e-4178-9703-fc4082d65c24/fitixasoxe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/391aea0b-2dca-4b61-b955-7728fe5005e3/sony_wireless_headphones_model_tmr-rf985r.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d1f9d1be-ffaf-42ef-ad47-b6d680111b95/fisher_price_toy_story_rv.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000deae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDEAE | 5324 bytes |
SHA-256: fff2bbe03243c2d6531045e1835cd71347117d5f558236404f8ba69c6a82046d |
|||
font_01_sfnt_off0000f0dd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0DD | 10988 bytes |
SHA-256: d2ddf29f0e2008e26e5592afec17af43a722d2d5ef0be50b0ef6e801571595d5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.