MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which point to PDFs hosted on various domains, suggesting a link farm or SEO poisoning tactic. The primary URL, https://vilenefex.ru/123, is presented as a search result for a free font, indicating a lure to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9984
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/123?utm_term=buxton+sketch+font+free+download PDF link annotation
- https://xefolulewonud.weebly.com/uploads/1/3/1/4/131406676/b50e85318.pdfIn PDF document text
- https://saremugofu.weebly.com/uploads/1/3/4/0/134017097/7e69a18be3.pdfIn PDF document text
- https://xogukozatakik.weebly.com/uploads/1/3/1/4/131453421/533fd.pdfIn PDF document text
- http://duwudivusupo.mygamesonline.org/whirlpool_front_load_washer_error_codes_e3_f8.pdfIn PDF document text
- http://goladelexugezi.sportsontheweb.net/vermont_castings_defiant_wood_stove_model_1945.pdfIn PDF document text
- https://rusiwenul.weebly.com/uploads/1/3/5/3/135327855/fuvexip.pdfIn PDF document text
- https://tiruvodeg.weebly.com/uploads/1/3/4/8/134892329/zozikududepaxuwawe.pdfIn PDF document text
- https://zevuvizaxetu.weebly.com/uploads/1/3/4/8/134887967/76eabde22dd76.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
- http://smc.org.inhttp://smc.org.inIn PDF document text
- http://www.opentle.orgIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/suzujewa/25767392869.pdfIn PDF document text
- https://s3.amazonaws.com/palikuvexake/blank_multiplication_table_worksheet_printable.pdfIn PDF document text
- http://telebil.rf.gd/lativupezupixud.pdfIn PDF document text
- http://gabepan.epizy.com/how_to_get_imovie_for_mac.pdfIn PDF document text
- https://s3.amazonaws.com/fajonubinomeder/zepotixixovumajowo.pdfIn PDF document text
- https://s3.amazonaws.com/wewiro/84288214750.pdfIn PDF document text
- https://s3.amazonaws.com/genukopapovixo/bhartiya_dak_sevak_online_form.pdfIn PDF document text
- https://s3.amazonaws.com/loneminovu/call_recorder_pro_mod_apk.pdfIn PDF document text
- https://s3.amazonaws.com/najubu/elegant_themes_free_templates.pdfIn PDF document text
- https://s3.amazonaws.com/gogunabones/bottle_feeding_guidelines_nhs.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text
Extracted artifacts 7
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_007_off00019ee4.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x19EE4 | 17324 bytes |
SHA-256: 3043fee0919d1e445df81a87a4aca419627d0be5e6ddc78a69b16a44b3aa1d60 |
|||
font_00_sfnt_off000130f8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x130F8 | 4032 bytes |
SHA-256: b542ef1d0cf58342b23e87094195c92fb3ef72b5f030548294c42bc8a90d406c |
|||
font_01_sfnt_off00013f72.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13F72 | 5216 bytes |
SHA-256: 474d61f7505adfe5d7e49d15a58213925b1b65981264d92e0202e5b5ac434f04 |
|||
font_02_sfnt_off0001513c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1513C | 3048 bytes |
SHA-256: 1b68eb0745f369bd9f805b89718582bd6ebaf917deeaaae5095027b3f32dc7b8 |
|||
font_03_sfnt_off00015d40.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15D40 | 6148 bytes |
SHA-256: be38186c9256ba0e64b07d34cca2e63b176d3ffd182ae4667a642b503e748fe0 |
|||
font_04_sfnt_off00016d20.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16D20 | 17188 bytes |
SHA-256: 9c3f653566bca6bee3ef95927c2785e9f50a81a5c86d6437aa5a7032f9c097ed |
|||
font_06_sfnt_off0001b85c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1B85C | 4324 bytes |
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.