MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://seumenha.ru/wix?keyword=queens+grant+community+school+jobs PDF link annotation
- https://cdn.sqhk.co/dejuxafe/6I1PF4Y/kobe_wallpaper_iphone_6.pdfIn PDF document text
- https://cdn.sqhk.co/nalawanuxa/hhhZNRT/21684993763.pdfIn PDF document text
- https://cdn.sqhk.co/gujowaxexag/1gh8nhh/what_is_the_most_holy_city_of_christianity.pdfIn PDF document text
- https://gozerezujokosas.weebly.com/uploads/1/3/4/8/134856803/tepusumelusozenexifa.pdfIn PDF document text
- http://circleshtang.xyz/how_to_start_a_new_paragraph_in_excel0oopl.pdfIn PDF document text
- http://scarcebook.com/869344583645lxua.pdfIn PDF document text
- https://cdn.sqhk.co/mizogujuzo/jhhikDE/steam_pro_software_free_download.pdfIn PDF document text
- https://ketadamofexawun.weebly.com/uploads/1/3/5/3/135349072/b8b9f.pdfIn PDF document text
- http://makamar.online/pathfinder_2nd_edition_class_guideskw13j.pdfIn PDF document text
- https://cdn.sqhk.co/xezexasag/ihhghe5/84775812165.pdfIn PDF document text
- http://netopodimamo.mywebcommunity.org/57004702470.pdfIn PDF document text
- http://jerimujolegem.medianewsonline.com/saxememisesuburub.pdfIn PDF document text
- http://brettlockhart.com/vadereridulpje7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/bda5af4a-1260-4089-93b6-3a8f3cc1cfb5/dunkin_donuts_138_stockbridge_ga.pdfIn PDF document text
- https://41c240d9-b4af-4f88-8fa4-2a41cce3a287.filesusr.com/ugd/01bc73_8737e9941ce5428f9b32a07ac0f3a029.pdf?index=trueIn PDF document text
- https://32cf4326-ba62-484c-a3ca-05d02c2dd2e5.filesusr.com/ugd/0b46e6_0b58e4be32144c37ab3eaabab762b177.pdf?index=trueIn PDF document text
- https://104cdeb5-cbd2-40ec-bb4c-cb5680d889f1.filesusr.com/ugd/9b2d9b_cebd6fac944346dbb38995ed8896e88e.pdf?index=trueIn PDF document text
- https://8f20b4bd-83f7-4a55-8c6f-e9501e2e061c.filesusr.com/ugd/c1c462_130807100f1749039e35ada38a32b1ce.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c3068e30-0025-4b3a-8d61-2011a0d4e73c/lozurubokukejukabofemimi.pdfIn PDF document text
- https://5637a596-61ce-4e67-8953-8fd9cb84b940.filesusr.com/ugd/c20ea7_eed363de4fb14b54ad673405689629df.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/135818e6-d278-4538-8fa3-cd7a9f036a2e/is_bram_stokers_dracula_a_horror_movie.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b99e9e45-9847-4d83-9ccb-c4ef7ec3af06/que_es_un_problema_de_investigacion_ejemplos.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f036.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF036 | 5592 bytes |
SHA-256: 1cff63dca6d866219bad4599b17dfa661671d3d14da8e6e221a05e6504bc49e9 |
|||
font_01_sfnt_off0001031b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1031B | 10440 bytes |
SHA-256: cbc42eb76635ec715586227eca8489014b5ca6b166f9739fa4af5071dc5f5d82 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.