MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafftec.ru/strik?utm_term=the+royal+road+to+card+magic+epub PDF link annotation
- https://bekefopu.weebly.com/uploads/1/3/4/6/134692172/5976161.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370791/normal_5fad3fac19b53.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423431/normal_5f9a73228f6e5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370764/normal_5f91348724234.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375206/normal_5fae3b028e7e0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366369/normal_5f8b1c545b3da.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368218/normal_5f905cf7d7692.pdfIn PDF document text
- https://kasukironumasex.weebly.com/uploads/1/3/1/4/131454791/sewesudoz-lolanini-mewijusezewatak.pdfIn PDF document text
- https://rabugotekinevod.weebly.com/uploads/1/3/1/8/131871666/8853281.pdfIn PDF document text
- https://vogizezadu.weebly.com/uploads/1/3/0/8/130814341/govuwe.pdfIn PDF document text
- https://bilewobadazape.weebly.com/uploads/1/3/2/6/132695578/zoguma.pdfIn PDF document text
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/8554420.pdfIn PDF document text
- https://wazuwivanesigov.weebly.com/uploads/1/3/4/4/134431766/456662a0ada873.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/46bc1dc9-a82d-4b96-b6bc-e811fcfcb451/super_fighters_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6082ebff-2f4d-4ca2-9dc2-b585c60fe198/asus_ramcache_iii_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/11fc94cb-7ece-4692-a840-fb518f686d38/small_flower_pots_with_drainage.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25ac6bcb-632c-4886-a253-118713c60ac6/rezeka.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off00011322.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x11322 | 18148 bytes |
SHA-256: cc410e453ec67f3ae7aaf5cc2dc5a58262b9f4336aa013155f59c7e57a92d782 |
|||
font_00_sfnt_off0000cbfa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCBFA | 5276 bytes |
SHA-256: 97a926239cfb3f1f9da15992824ca181bff2cc4394cdf869f562b9bb22ca253a |
|||
font_01_sfnt_off0000ddec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDDEC | 5200 bytes |
SHA-256: 4ff498e5e34346602d4bdf7e9c81c37fbd15ffa724fb95c016b2f5f57df86d3e |
|||
font_02_sfnt_off0000eee9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEE9 | 10596 bytes |
SHA-256: f4acc812800be3da6baff677a2683c0d0b2717797c03bb1d554800340f869f7d |
|||
font_04_sfnt_off00012f63.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12F63 | 4324 bytes |
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.