MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mezovuduw.ru/strik?utm_term=libro+de+ciencias+f%25C3%25ADsica+2+secundaria+contestado PDF link annotation
- http://instapriz365.online/physics_30_worksheet_4_conservation_of_momentum_2_answersiyklb.pdfIn PDF document text
- http://creditscorehelp.info/12325263344gbol9.pdfIn PDF document text
- http://mumolazesinidix.getenjoyment.net/bohemian_rhapsody_classical_guitar_tab.pdfIn PDF document text
- http://7evenrp.ru/rijotekajisumazo2w6mg.pdfIn PDF document text
- http://skidki-day.site/bozulesepepdcjq.pdfIn PDF document text
- https://jonipafatanepa.weebly.com/uploads/1/3/2/7/132741476/gijazegetamil.pdfIn PDF document text
- http://asta-stroy.ru/1520815237850kij.pdfIn PDF document text
- http://triple-doska1.club/16965980413byj63.pdfIn PDF document text
- https://menanotiji.weebly.com/uploads/1/3/4/3/134322389/zorefozosinaparazes.pdfIn PDF document text
- https://dalulasu.weebly.com/uploads/1/3/4/4/134493325/376897.pdfIn PDF document text
- https://kexekogu.weebly.com/uploads/1/3/1/3/131384418/zidekopitenepo.pdfIn PDF document text
- http://ketosimple.online/367653564549z3dc.pdfIn PDF document text
- http://raponikidosal.getenjoyment.net/samsung_refrigerator_rf26hfendsr_aa_parts.pdfIn PDF document text
- http://asta-stroy.ru/how_to_put_a_heavy_duty_stapler_back_togetherk7pgd.pdfIn PDF document text
- https://gamevuwi.weebly.com/uploads/1/3/4/5/134525912/naniwujokulofo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://965bd944-310b-4209-a71a-d16e45aaced4.filesusr.com/ugd/5f02e6_51a2bdf4510747d5afe0880f733e5144.pdf?index=trueIn PDF document text
- http://vebusatoro.atwebpages.com/8752645496.pdfIn PDF document text
- https://c06d174a-caca-4ab2-b5a0-4525cd3135d4.filesusr.com/ugd/856cea_95c05eef20554a0091aa00495baa0691.pdf?index=trueIn PDF document text
- https://88e92b2d-3ddf-41b2-a2ae-4af48bfba274.filesusr.com/ugd/b74686_d66a5e32767e41f48c6df70cf13a3747.pdf?index=trueIn PDF document text
- https://67bb8873-ca08-4da4-87c0-60a8072ebff6.filesusr.com/ugd/a838c0_46a5006a7cac4e54a4c82bafdbb18c65.pdf?index=trueIn PDF document text
- http://bitines.myartsonline.com/sibubixur.pdfIn PDF document text
- https://39472683-7d43-4bc3-882b-0947a83fd973.filesusr.com/ugd/544c7e_8aca5d771ef347af9b5aaf27610b4f7b.pdf?index=trueIn PDF document text
- https://0ca3454e-05ac-49fc-8d00-644b1af7be3c.filesusr.com/ugd/8bf3fc_1daefff56a2241d0a81b4c1ecc27edba.pdf?index=trueIn PDF document text
- https://cad90261-f038-4e8a-b384-2e0e37e6cb8c.filesusr.com/ugd/4c4e45_a8d11c7f15c0429a8591f4f7b67e96ce.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ddf9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDDF9 | 5248 bytes |
SHA-256: 61d30bd5ad85b4eb1a590a06353bdbcab6ae2d49ce9c34c54c227171806e847e |
|||
font_01_sfnt_off0000efea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFEA | 11800 bytes |
SHA-256: b4694182c016a0103d2d3672c948c5bec0f23c35fe9ee3b6f3bfa3ef09322d5c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.