MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing attempt. The presence of a 'download' button lure and the ClamAV detection as 'Pdf.Phishing.Trojan' strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and link farm behavior are indicative of a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9982
Heuristics 7
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/123?utm_term=clash+of+clans+mod+apk+ios+2018
- https://fokutape.weebly.com/uploads/1/3/2/8/132814024/notaperuwo_tekarovumawetas.pdf
- http://bexukavinawexov.mygamesonline.org/porixamokalerineroro.pdf
- https://xotagolopotipik.weebly.com/uploads/1/3/4/7/134713968/9741016.pdf
- https://fatibetoliwan.weebly.com/uploads/1/3/4/7/134731660/07f63d0010c.pdf
- https://gilaxisob.weebly.com/uploads/1/3/1/4/131406303/9433095.pdf
- https://cdn.sqhk.co/fazofasufiwu/zRjiijv/mrcrayfish_furniture_mod_1._16_1.pdf
- https://pozivikebesar.weebly.com/uploads/1/3/4/7/134759309/bever_pisamup.pdf
- https://bixevojug.weebly.com/uploads/1/3/0/7/130739122/gaturivi_lemonamodin_kuxezil_nuzopidezelaba.pdf
- http://bnl-jobs.com/maytag_quiet_series_300_start_button_not_working37uno.pdf
- http://ceter.xyz/854710791592gq3n.pdf
- https://cdn.sqhk.co/daxutoxod/hbMmhgi/managing_technological_innovation.pdf
- http://nokasosozigof.mypressonline.com/2491603252.pdf
- http://psychologyrelax.xyz/why_composites_are_important_in_the_aerospace_industryv1doh.pdf
- http://hookup154.online/alabama_song_weillqz4d1.pdf
- https://palepolute.weebly.com/uploads/1/3/5/9/135963306/5540344.pdf
- http://waliduv.mypressonline.com/lorexogo.pdf
- https://xibijogoxedugo.weebly.com/uploads/1/3/4/6/134662411/8143650.pdf
- https://cdn.sqhk.co/mudebijutene/bhhidhP/car_running_rough_meaning.pdf
- https://cdn.sqhk.co/konidadelan/jgfichf/my_little_pony_rainbow_runners_free_online.pdf
- https://nutarubanamu.weebly.com/uploads/1/3/4/5/134528768/kaxaletuza.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/06792134-f240-4851-a09d-18a38f65a424/hornady_progressive_reloading_press_review.pdf
- https://uploads.strikinglycdn.com/files/5c1a1e45-6651-425b-857d-f30125d28016/sufusimiwekamemilosimuwew.pdf
- https://uploads.strikinglycdn.com/files/c799ee8e-0af1-4ce6-b729-7445059c2610/pipogoj.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000104d0.bin9d542b3e388966add0c58544ec143f87e4c1643b4c9b66984739319c40a69955 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104D0 | 5788 bytes |
font_01_sfnt_off0001185f.bin6d2a3a16cc464ce72cf05976c7f96a31c93af2202e0dc760c37a694345e222ee |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1185F | 1800 bytes |
font_02_sfnt_off000120ef.binf68d5798ec4bab9ce25a7203642de1e4c35bf64820151607cff8d87844210f9e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120EF | 11324 bytes |
font_03_sfnt_off0001476e.binb2563e85233037e3c2780690ed1455257f868516b5a962e54e6ffe29314c9cb1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1476E | 16312 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.