MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=how+many+calories+in+a+steak+quesarito PDF link annotation
- http://xajavawinereko.mywebcommunity.org/genaxuf.pdfIn PDF document text
- https://cdn.sqhk.co/finelega/WsNsjhb/lighthouse_point_cedar_point_reviews.pdfIn PDF document text
- https://cdn.sqhk.co/rokajoten/g4UpyBi/81129792425.pdfIn PDF document text
- http://zitirisiz.mywebcommunity.org/achyutam_keshavam_rama_narayanam_lyrics.pdfIn PDF document text
- https://cdn.sqhk.co/fefamujigip/X927hjj/curtain_track_installation_guide.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/pusixa/craftsman_yt_4500_mower_deck.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d02d8e6a-00aa-4325-a0c9-ba6c6038a137/30293283151.pdfIn PDF document text
- https://s3.amazonaws.com/niporofez/wawederaperu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7a45d9e-c3ac-447e-9e96-92432234c52b/nobedunomafetele.pdfIn PDF document text
- http://bosagiriwamokin.onlinewebshop.net/jay_macleod_aint_no_makin_it_summary.pdfIn PDF document text
- https://s3.amazonaws.com/bejeseja/at-lp120xusb-bk_direct_drive_turntable.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e4e574a-5520-48da-bd83-0bf38f8d74e8/aci_301-99_specifications_for_structural_concrete.pdfIn PDF document text
- https://s3.amazonaws.com/bugutaj/dyson_ball_vacuum_cleaner_casdon.pdfIn PDF document text
- https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_9b31580d495c4ee881cdddedc5ccaa54.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/75dc0467-6767-43e8-9b36-719fd8443d73/can_you_take_your_motorcycle_permit_test_online_in_minnesota.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a9b666a7-a865-46da-8fd9-0c53e1826d3b/babubetuwurugufek.pdfIn PDF document text
- https://44f68060-d5e3-4d58-b4e7-e3760392f352.filesusr.com/ugd/49488e_f171af2e3ec849e081c88a4a6a78fad9.pdf?index=trueIn PDF document text
- https://ae26bae5-b1f3-4fb2-a0ba-5d2f2d23988c.filesusr.com/ugd/aec2ea_f64c54986c9748169b9c63c7ece4f966.pdf?index=trueIn PDF document text
- https://c751e6e8-0850-424d-b14e-d7ae46260796.filesusr.com/ugd/bc1028_7c87113f35be470b8640b820b6b9cec2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1f4ef373-f05c-4afa-88d0-2b327a7a3c54/jekedolebitigetazafomoli.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/672c23f5-1e6b-44e7-b3bd-69fd08ce92b2/52080230261.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010737.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10737 | 5292 bytes |
SHA-256: c77b97ef76b4eaeb7d48abbf9d39e534170d2a2e94a72f18e7cd184b4c6ad5fa |
|||
font_01_sfnt_off00011933.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11933 | 11248 bytes |
SHA-256: 2c0da6c24667a19586c5f005920371b935fc5cfdf3ec5e8626ad99ae2eec7884 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.