MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm used for phishing or malware distribution. The document body, though heavily obfuscated, appears to be a lure related to a carbon monoxide detector manual, aiming to trick users into visiting malicious URLs.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/strik?utm_term=first+alert+carbon+monoxide+detector+manual+co400 PDF link annotation
- https://gugekomu.weebly.com/uploads/1/3/0/9/130969097/a18c19d3d3fd8e6.pdfIn PDF document text
- https://cdn.sqhk.co/kuwusemob/hgjfEja/pdf_annotator_free_portable.pdfIn PDF document text
- https://telemoradez.weebly.com/uploads/1/3/1/0/131069753/figewene.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487409/normal_604926ce97858.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4471692/normal_5fe33a8a551f7.pdfIn PDF document text
- https://cdn.sqhk.co/woleparos/dkhhnyh/langrisser_1_and_2_switch_review.pdfIn PDF document text
- https://lizakefamejoxen.weebly.com/uploads/1/3/1/3/131384135/8939525.pdfIn PDF document text
- https://bajipupetezin.weebly.com/uploads/1/3/5/3/135315063/sogujigujozelewuleg.pdfIn PDF document text
- https://cdn.sqhk.co/zedugixaka/BoPggkY/gafalogolipisimoreki.pdfIn PDF document text
- https://vejevidumuruje.weebly.com/uploads/1/3/5/3/135302175/dufabel-lisenu.pdfIn PDF document text
- https://xonajababivoxo.weebly.com/uploads/1/3/4/0/134040492/5dc78bbf2f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421778/normal_5fcaeb971e23e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/56299014-2671-4461-9113-0d82273c698d/67899242963.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce88a0f4-7215-49fa-a8c6-e281a3287d17/hp_p2035n_printer_driver_for_windows_10_64_bit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad013e88-657e-4d52-86fb-2c6905fe2b47/39679469710.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/708bf31a-ed38-4339-a71b-de8d12d59d64/dremel_4000_price_philippines.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/51c1c2fd-7af2-4fe7-8528-cc51c0d50ceb/nunileje.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c2a5fc9a-d433-4dda-9d88-cd3e629c628c/danby_8_000_btu_portable_air_conditioner_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ee0498f-4327-4a53-8813-633964f6c0d4/xarigo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/31cdab0e-edc9-428f-8dfc-b33f8bc24d72/what_is_safety_osha_definition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97b0a27c-a409-4759-8fba-8ae1afb81ca9/how_to_call_unemployment_washington_state.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010cea.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CEA | 5476 bytes |
SHA-256: b6108046d2f072638f3da9533bc8e1aca303e87b2c60cc88a421fd45a4187cf6 |
|||
font_01_sfnt_off00011f7c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F7C | 10328 bytes |
SHA-256: 78475119c5feada1e02434528c9f48db878156a5298edf8ba856540e1131c218 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.