MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=how+to+meditate+kriya+yoga PDF link annotation
- http://creditscoretracking.info/chicco_bravo_trio_system_with_keyfit_30_infant_car_seat_review01p4h.pdfIn PDF document text
- http://zopokujejisolan.getenjoyment.net/how_to_convert_to_word_on_apple_computer.pdfIn PDF document text
- http://moxegelubopidi.sportsontheweb.net/high_tibial_osteotomy_technique.pdfIn PDF document text
- http://flathead.us/cul_es_la_edad_de_jubilacion_en_estados_unidoscdln7.pdfIn PDF document text
- http://consequences.space/lupudamelefer1d.pdfIn PDF document text
- http://ririzobe.medianewsonline.com/public_private_partnership.pdfIn PDF document text
- http://xovijezup.mywebcommunity.org/sap_abap_interview_questions_and_answers.pdfIn PDF document text
- http://ruwazumusef.scienceontheweb.net/57783553151.pdfIn PDF document text
- http://mebevevi.mywebcommunity.org/beat_the_market_edward_thorp.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://436240a4-ef10-404e-ad90-c5cab949c7af.filesusr.com/ugd/3fb742_3958f78690994494bf0882fe655c951b.pdf?index=trueIn PDF document text
- https://601bead5-a720-4f65-98db-62fe2a42cb91.filesusr.com/ugd/0e52b4_9aeb423fc6264103964ef4b34e490751.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d7c1c1df-2bc9-42ec-bda4-0a01989e1954/how_to_cook_oatmeal_in_hamilton_beach_rice_cooker.pdfIn PDF document text
- http://ledaruwevegoxu.onlinewebshop.net/rulagidelevupoxun.pdfIn PDF document text
- https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_877cd3191976478c8af219f8ceab3790.pdf?index=trueIn PDF document text
- https://d064ede3-316f-4d13-8ec5-014b2136b3bd.filesusr.com/ugd/154db6_38ca6f8c2669475b9552c0b7acaeba5e.pdf?index=trueIn PDF document text
- https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_4c44c6604251450a904eaf22adf194b3.pdf?index=trueIn PDF document text
- https://0f424234-9c27-4462-a606-4b2ccecf17d8.filesusr.com/ugd/b42a09_83b8727618fc47c69a8fbd0a9c7d4d89.pdf?index=trueIn PDF document text
- https://badbb018-ab4e-499b-b788-960949b82e3d.filesusr.com/ugd/4f4c56_2a121438b88448b49bacc5a2c525b149.pdf?index=trueIn PDF document text
- http://fowimifefezujo.myartsonline.com/62134684976.pdfIn PDF document text
- https://9c789f27-b70c-4c9d-9e83-211ee8f99b38.filesusr.com/ugd/bdeb4c_2d54cf2d78c744a5b18d7d147e1e72a2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/349f623c-cab5-48de-835f-db97a7dc06e3/does_walmart_print_cards.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec12.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC12 | 5156 bytes |
SHA-256: 2723e3339a2d085b51841880e40a2bcbbc3b7b0270a2b6e9861f306160a9fc89 |
|||
font_01_sfnt_off0000fd9c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD9C | 10376 bytes |
SHA-256: d760d4da6acd546925d884e8180759f111df377a8e6794a69842af846c3fafbf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.