MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://soxebez.ru/strik?utm_term=how+to+install+amazon+flex+on+android PDF link annotation
- https://nawawedivoxoni.weebly.com/uploads/1/3/4/7/134719505/5855023.pdfIn PDF document text
- https://xulewanexu.weebly.com/uploads/1/3/4/1/134108589/febapexasulan-sobetabimob-wokudik-dipij.pdfIn PDF document text
- https://bawenijujobafo.weebly.com/uploads/1/3/4/6/134670929/8790267.pdfIn PDF document text
- https://funugunuxu.weebly.com/uploads/1/3/4/3/134384448/9402782.pdfIn PDF document text
- https://bimipesetasezi.weebly.com/uploads/1/3/4/0/134017520/tibajodape.pdfIn PDF document text
- https://mologikonazo.weebly.com/uploads/1/3/4/7/134706863/vetudedit.pdfIn PDF document text
- https://xikewipevugid.weebly.com/uploads/1/3/1/3/131383679/610c57cb2a4f3.pdfIn PDF document text
- https://negofajosodin.weebly.com/uploads/1/3/5/3/135314147/lifajitomox_gemuvuv_papuwewe.pdfIn PDF document text
- https://neverazu.weebly.com/uploads/1/3/4/9/134901342/pikavexo.pdfIn PDF document text
- https://botitanape.weebly.com/uploads/1/3/0/9/130969352/2196147.pdfIn PDF document text
- https://zegejuxinubu.weebly.com/uploads/1/3/4/7/134730654/6283a.pdfIn PDF document text
- https://ramasiwo.weebly.com/uploads/1/3/5/3/135390431/ragamazi_bazemodizoxab_fozudanepuza_fakovupobelep.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0499bdae-1cf0-4317-ac0d-f6eeaac4d03c/amc_8_2019_winners.pdfIn PDF document text
- https://s3.amazonaws.com/dutuzanob/nenoribavusote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/96efab30-6710-41bc-a71e-0012b25817ef/how_to_write_poetry_download.pdfIn PDF document text
- https://s3.amazonaws.com/wemazun/schwinn_stationary_bike_ic3_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e6596701-8556-4f5f-a664-382cc998a168/texas_instruments_ti-30x_iis_battery.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b83fc885-7ef0-40fc-ad0f-14536da8ecc0/unlimited_power_meme_no_sleep.pdfIn PDF document text
- https://s3.amazonaws.com/wolina/1965165830.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5f0d8db-d378-458e-8f97-d9148fa42741/29464705046.pdfIn PDF document text
- https://s3.amazonaws.com/xupovobejanam/85555679357.pdfIn PDF document text
- https://s3.amazonaws.com/jokotaziweluge/xigibekejo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed4e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED4E | 5224 bytes |
SHA-256: 9328c125a02a14f1e05bb3c14c59024a30118c96c65d45a38a1fdb1081056469 |
|||
font_01_sfnt_off0000ff1a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF1A | 10820 bytes |
SHA-256: 3aaa034dbbb9a68589c4f31104de02d2a0b0d2fa72cb1f397a65cc528eeeecf0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.