MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to direct users to potentially malicious content. ClamAV and ML classifiers identified this as a phishing or malicious PDF. The presence of embedded URLs and the overall structure strongly suggest a phishing or malware distribution attempt, likely initiated via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/123?utm_term=record+of+informal+discussion+template PDF link annotation
- http://goligofalu.medianewsonline.com/allegory_of_the_cave_by_plato.pdfIn PDF document text
- http://lemixebu.22web.org/21011817512.pdfIn PDF document text
- https://pelabomorifij.weebly.com/uploads/1/3/4/6/134628360/fd6f38e6b632f.pdfIn PDF document text
- https://xegazoniwenopuk.weebly.com/uploads/1/3/6/0/136011370/xorilipibibo.pdfIn PDF document text
- http://zexawof.22web.org/lexoketezugisinozib.pdfIn PDF document text
- https://bapumora.weebly.com/uploads/1/3/2/7/132740837/nagaku.pdfIn PDF document text
- http://wuwubaga.22web.org/expense_report_reminder_meme.pdfIn PDF document text
- http://xepuxupipe.mywebcommunity.org/dapevo.pdfIn PDF document text
- https://fimiwopagib.weebly.com/uploads/1/3/5/3/135315251/2475819.pdfIn PDF document text
- https://gavuzolarot.weebly.com/uploads/1/3/4/4/134458525/sazibusagidofupepo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://vovajixavago.epizy.com/fomoximivuxetuvuwafo.pdfIn PDF document text
- http://sutepaxevak.epizy.com/kokosiwofekur.pdfIn PDF document text
- http://magikid.epizy.com/sales_assistant_cv_template_word.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a4745b17-86a4-476a-a649-f5e2e650b2ce/how_to_smoke_on_char_griller.pdfIn PDF document text
- https://d4a58959-25bc-41ae-a48c-99f47e3c4711.filesusr.com/ugd/4dab1e_61b80078c88242039aa2427fdcf4be38.pdf?index=trueIn PDF document text
- https://945b3f91-9c76-4178-be32-f0dab3cfe2c6.filesusr.com/ugd/8d5d69_d696c9e7c63c41ccb3443a03fb9003f2.pdf?index=trueIn PDF document text
- https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_26c6afcf8c194495a7ab3b1c517a0152.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/aba9ae0a-8baa-4ec4-b854-cf9b1453143d/3983385361.pdfIn PDF document text
- http://palelezugob.onlinewebshop.net/kutejoxonekefizepise.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db72f0ba-b43d-4b8a-be5f-749eafd8dbc3/como_hacer_un_taller_educativo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d30b414-4cfa-44f6-90e7-286b440ebe44/66532410030.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5b6d164-58d9-4e35-b33c-e7964e21d1b8/what_illegal_activities_in_mom_luby_engaged_in.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eff7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFF7 | 5308 bytes |
SHA-256: 65a7d8b81b16622bc93a99760dc8c3a0ebca7cf13ff42e309b5149e48825ebdf |
|||
font_01_sfnt_off000101f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101F1 | 10540 bytes |
SHA-256: e6ec0ddacbf13c193f62c0d00813b6e3fbefa2619923f6123def3b8de250ba54 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.