MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/pbw?utm_term=botw+attack+up+elixir PDF link annotation
- https://jazuwexakabe.weebly.com/uploads/1/3/2/3/132302764/miwudave.pdfIn PDF document text
- https://wixolovab.weebly.com/uploads/1/3/0/7/130776385/fetarulizig-zojugove-miwiwetivumi-duridonolefoso.pdfIn PDF document text
- https://foxakiletomuxo.weebly.com/uploads/1/3/4/0/134012751/285024.pdfIn PDF document text
- https://xonujofepip.weebly.com/uploads/1/3/4/3/134385468/d6dc1c.pdfIn PDF document text
- https://gubonikeralovuz.weebly.com/uploads/1/3/4/5/134519346/fuwopemu-japaponadij-lupeni-moxem.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4467561/normal_6021c22faf312.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407084/normal_600805f129383.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459623/normal_604eecd0baf5c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426549/normal_602d04f21c293.pdfIn PDF document text
- https://pevekalarukug.weebly.com/uploads/1/3/4/3/134318906/buxilonidegokise.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4469350/normal_5fca7f64574a2.pdfIn PDF document text
- https://rixonusoraj.weebly.com/uploads/1/3/0/7/130738646/mepot.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0756d673-5dcb-44eb-8709-04a413e592c5/xovaka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0020c04f-74fc-45f6-87eb-6f1273ea32b4/how_to_test_the_stickiness_of_tape.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/83f75c5b-98bd-4520-99b4-003b5e46abeb/mopowa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1e3387a6-3d62-443c-96cc-1007bd582934/sivitigimaremogutubu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7120d66c-2073-49f3-b277-a535b6e83292/ripugipewasi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c13bf0bf-d139-47b7-bab6-e2a9e7cf07ed/public_liability_insurance_certificate_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf9676fa-3ce3-4a75-9154-cda4aaf99dbd/how_to_make_a_simple_friendship_bracelet_with_wool.pdfIn PDF document text
- http://werinenimuta.pbworks.com/w/file/fetch/144728265/how_to_find_dependent_and_independent_variables.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e745845c-46fb-46d1-8353-2df3440fe61e/teknetics_delta_4000_tips.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dcb8f98d-0ed9-4b8c-9ae8-f18782060c19/lamonozuzujepekumemasaven.pdfIn PDF document text
- http://zuwofig.pbworks.com/w/file/fetch/144808131/57616068259.pdfIn PDF document text
- http://guronavageba.pbworks.com/w/file/fetch/144500535/othello_as_a_tragic_hero.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f40a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF40A | 5024 bytes |
SHA-256: 501848f42b4a0812d7cd3c00d682cf442e152a584e8f842deb24493f32cfec86 |
|||
font_01_sfnt_off0001054c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1054C | 10328 bytes |
SHA-256: b7c7bcdb7b2637df9580c00a9ef280f67587c44468f63baa05ef27fcef201ecd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.