MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged as malicious by a ClamAV signature and an ML classifier. It contains a large number of external links, many pointing to disposable domains, suggesting a link farm or phishing campaign. The embedded URLs and the heuristic firings indicate an attempt to redirect users to potentially malicious websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/123?utm_term=mermaid+tail+template PDF link annotation
- https://mamudige.weebly.com/uploads/1/3/0/8/130874639/puladelugalog.pdfIn PDF document text
- http://potolkilife.ru/bojefasokesiv9ktix.pdfIn PDF document text
- http://wiinorama.fun/on_the_incarnation_saint_athanasius99nn9.pdfIn PDF document text
- https://nikovazof.weebly.com/uploads/1/3/2/6/132682709/4804667.pdfIn PDF document text
- http://xamawigokoke.mygamesonline.org/gevapugigijitomuweni.pdfIn PDF document text
- http://botefin.medianewsonline.com/30622390234.pdfIn PDF document text
- http://fakaripeti.xyz/58691141634xk8oc.pdfIn PDF document text
- http://goldstein.berlin/black_guy_short_hair_memezz81s.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0521b259-726f-45fa-8e0c-4ac169a1461e/9870410637.pdfIn PDF document text
- https://cb2d4818-2134-4ea5-ae57-1bc45cfc4292.filesusr.com/ugd/7e787c_5e7ec1c97d204acdabf7f0e6ef22b1ad.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b01067d7-4f48-4062-85ef-21f09aff1554/95788242140.pdfIn PDF document text
- https://793776f3-68b4-44d3-947a-596ce2c6f652.filesusr.com/ugd/4e977a_74fe59b18a234a2db47c33b1d3b80534.pdf?index=trueIn PDF document text
- http://tajavuminona.atwebpages.com/writing_formal_letter.pdfIn PDF document text
- https://c31d65df-273c-4bcc-acfb-7b03b0724b99.filesusr.com/ugd/e7e4a0_48e0f24b51a94439b975457d05e17f43.pdf?index=trueIn PDF document text
- https://a1f0096d-76f5-425c-b826-5ccbd312c1bc.filesusr.com/ugd/8f8c07_02ac104fd6044838bd615b92a3a79837.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d815a6ef-8ef1-48f6-991d-1b4323822a50/stephen_king_free_scripts.pdfIn PDF document text
- https://71b4061d-0fbe-47a8-a671-08758978b022.filesusr.com/ugd/0216f2_a89dcce999124fb884c1c8a318ee2c03.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b87cb1d2-45ae-411d-8277-d25521252619/gonakopilemozojubadadar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c32a6e11-89f2-41ef-b0b6-12a1af8f695f/87233481532.pdfIn PDF document text
- https://71a0d42b-91d5-4e94-9338-ff69ca8a624b.filesusr.com/ugd/e5d5e5_9eb98c6647964257acddb8be2a4f86bd.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d5cd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD5CD | 4932 bytes |
SHA-256: adc8530bf781ed688dcfc1f92e8d3dd8ccbbf56f413213ca68ffa95c4d0bcd21 |
|||
font_01_sfnt_off0000e682.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE682 | 11544 bytes |
SHA-256: 49e040fd0a55a3090084e99b21aadc0597305f19c76616206683bc75c75e7b3a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.