MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation scheme. One of the embedded URLs, 'https://maypoin.ru/123?utm_term=mejor+biblia+de+estudio+reina+valera+1960', is flagged as unknown reputation, and the document body contains garbled text along with what appears to be metadata from wkhtmltopdf.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/123?utm_term=mejor+biblia+de+estudio+reina+valera+1960 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4458848/normal_5ffa212c1bf6c.pdfIn PDF document text
- http://sexedate69.site/63654670808hkeea.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4459034/normal_5fdf47a4e8b02.pdfIn PDF document text
- https://naxosetoj.weebly.com/uploads/1/3/0/7/130775404/runakewe-kogino-zubexikisijo-zukukibumebot.pdfIn PDF document text
- http://8bitbeardsco.com/the_monkey_king_2_full_movie_in_hindi_hd_video_downloadh3uo5.pdfIn PDF document text
- http://vedevedonumizak.iblogger.org/filme_von_ard_mediathek_en_kostenlos.pdfIn PDF document text
- http://fitdieta.com/monster_hunter_2020_tamil_dubbed_movie_download_tamilrockersrh0a7.pdfIn PDF document text
- http://copyrighytsupport.com/quality_technician_certification_from_the_american_society_for_qualityac9ur.pdfIn PDF document text
- http://mon-cmbretagne.com/nusekosenavenosapedia8qkw.pdfIn PDF document text
- https://piwutevuxave.weebly.com/uploads/1/3/4/8/134891910/5062591.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453720/normal_5fe7c7ee8bb55.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_49133029eb234973afdbde065cddf917.pdf?index=trueIn PDF document text
- https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_d3bf230848e345b58fb4108582ea6d81.pdf?index=trueIn PDF document text
- http://vubalek.epizy.com/setajixunuwiv.pdfIn PDF document text
- https://170a7d3c-74f0-42f5-9ead-98ae292a4922.filesusr.com/ugd/a18aa6_149bcba4f9e04cb2811e363fb92a729a.pdf?index=trueIn PDF document text
- http://gizimup.epizy.com/android_autofit_textview.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ebf11b89-2cb9-4e51-93ec-d00f72f48f48/little_alchemist_combos_diamond.pdfIn PDF document text
- https://14535e1a-360a-4d01-a655-fa33e115c80e.filesusr.com/ugd/b222ea_477c97d3f7954e9fb67eca0275ffb419.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/27d247e7-cadf-456e-ae33-033fca2a772b/how_to_clean_drain_filter_on_kenmore_washer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a8297f35-9a29-4717-aa4b-d86040504a88/65189583998.pdfIn PDF document text
- https://a72b158e-cead-41d6-a0b3-8518216316a4.filesusr.com/ugd/35c6e2_1c646ad6fd0e434e932d5bfdf7c03d59.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/76898693-dc13-4f1f-8341-4ae5c12bb50f/21101315778.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010048.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10048 | 5604 bytes |
SHA-256: 77adff52da66f92261e89b35320a72a2309074d972f567ac5ee3a9add1e4a070 |
|||
font_01_sfnt_off0001136e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1136E | 11796 bytes |
SHA-256: 474f36924bd65ddf5ff52dc28107013d6031f9a1ab141ca6e83792d3cccd24b6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.