MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/pbw?utm_term=mahabharata+full+story+in+kannada+pdf+free+download PDF link annotation
- https://static.s123-cdn-static.com/uploads/4446382/normal_5fe546c18d4f0.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4452861/normal_5fcf1625af3cf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487903/normal_6047576f9076a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483388/normal_60191063659f5.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://sagidetubi.pbworks.com/f/fundamentals_of_building_construction_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6badc62d-60ed-4fe4-8e08-6e922e511862/30651362724.pdfIn PDF document text
- http://kuxuraroj.pbworks.com/f/15503547461.pdfIn PDF document text
- http://nagomax.pbworks.com/w/file/fetch/144425718/how_to_clean_a_lavazza_modo_mio_coffee_machine.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b61b6c0-b35b-4f89-a926-47c2dca99c35/72450566648.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a9eadfc0-18a6-46d3-b9cd-62bfb1ca1a08/wivifegonufilexojivop.pdfIn PDF document text
- http://dawanitapix.pbworks.com/f/partitive_proportion_examples_with_answers_grade_6.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1559a00d-9a2c-460e-8066-36462f5cb6b9/11314607588.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3ed1f28-635a-42ae-89ca-0e07f46a29d2/33140476135.pdfIn PDF document text
- http://lewomirat.pbworks.com/w/file/fetch/144866358/irobot_roomba_965_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1b011e6c-04eb-47aa-9217-6a3222da2a0c/pavoraxonegolazen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1cf825b6-d86d-4f4d-9dca-b8c25fcc78f8/zagg_keyboard_spacebar_not_working.pdfIn PDF document text
- http://pitavumiza.pbworks.com/f/dork_diaries_13_ebook_download.pdfIn PDF document text
- http://gatasulupu.pbworks.com/w/file/fetch/144412059/2019_hellcat_red_eye_charger.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dda8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDDA8 | 5412 bytes |
SHA-256: 05ee79c59ae88622c6a56a20c4b8bd1491a3ef9dd629b59151cf0a970e73af00 |
|||
font_01_sfnt_off0000f01b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF01B | 4376 bytes |
SHA-256: 7a1eb1555d340d294a898384b9c11c4f0c92c1699892ec68bc18501b505b43f9 |
|||
font_02_sfnt_off00010055.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10055 | 11104 bytes |
SHA-256: 96a8ef52c841221e1fe25790a18ff00c154d1a15182750536b22201584f1b32f |
|||
font_03_sfnt_off00012550.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12550 | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
font_04_sfnt_off0001334a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1334A | 3948 bytes |
SHA-256: 82bda2c2b93b96f0365d050952936695a838e58dc91205a65651e4b0438dec3a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.