MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable domains, suggesting a link farm or SEO spam operation. The primary URL, 'https://golowaki.ru/strik?utm_term=how+to+replace+furnace+pressure+switch', indicates a lure related to home maintenance. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/strik?utm_term=how+to+replace+furnace+pressure+switch PDF link annotation
- http://vidclips.design/mapa_de_carreteras_de_mexico_202013rin.pdfIn PDF document text
- http://covidcapsule.world/6176880395o9g14.pdfIn PDF document text
- http://strapslap.online/457453154642mkye.pdfIn PDF document text
- https://cdn.sqhk.co/nomuzali/jRij4hi/allegiant_stadium_seating_chart.pdfIn PDF document text
- https://cdn.sqhk.co/kubibosujiko/0ggcsje/wativelovemewudikuwetubos.pdfIn PDF document text
- http://pagebake.com/35826921669nqqzs.pdfIn PDF document text
- http://eroganoficial.site/matlab_fft_ifftstljk.pdfIn PDF document text
- https://cdn.sqhk.co/zokirafuka/hbiiE8p/balkar_ankhila_driver_song.pdfIn PDF document text
- http://fortysgjdk.fun/line_6_spider_iv_15_amp_reviewg9tdu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/bisegilupuf/what_does_the_veil_represent_in_the_bible.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e01692d1-db97-4d88-b2e1-b2d38348bf0c/kimaba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15a5eb56-096f-44c3-a2b7-6db235e5899a/75196902104.pdfIn PDF document text
- https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_873a141469d2444bbd25b18fdf3a6ae5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e0cc16d6-8e6c-470e-9f1c-8eccc7069320/menofikaxo.pdfIn PDF document text
- https://cd489911-dc6d-4439-b408-84622343fb93.filesusr.com/ugd/d8e941_f52a06c783514860b6d4a2f1b118c9b2.pdf?index=trueIn PDF document text
- https://84d51d8d-5932-465a-b044-5d36dace581c.filesusr.com/ugd/98e2de_097bd4db6a4a453bb98184d2a79ce295.pdf?index=trueIn PDF document text
- https://5b5cf7c4-d983-4e27-bd54-44d52fc9074e.filesusr.com/ugd/2f9450_d29fe2856076497c9b5a8cd3788476b8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c0235f19-2030-4a58-9743-d72b30723af3/all_american_pressure_canner_921_in_stock.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b7c42ef9-5a30-419a-bc49-2228a8897094/what_are_some_negative_calorie_foods.pdfIn PDF document text
- https://s3.amazonaws.com/retobifulipo/5816003383.pdfIn PDF document text
- https://4eb3a9b5-ca6a-4b2a-896e-878abc754f3b.filesusr.com/ugd/f1ab86_27db22360f6e4502902ec7b683cffab0.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gifojuxaxeva/37326287620.pdfIn PDF document text
- https://s3.amazonaws.com/gurafoga/caballo_de_troya_10_gratis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec12.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC12 | 5156 bytes |
SHA-256: 37b58e937bee5b03aca230ef13d6adbb0c71d397da852d3a737a769c98d783fe |
|||
font_01_sfnt_off0000fda7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDA7 | 10756 bytes |
SHA-256: 15c8144c6240dc92e90a030dcb4b62495ddeb3e293dde58623109d6d0616ee6c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.