MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/strik?utm_term=uke+songs+easy+chords PDF link annotation
- http://sasavojaraw.iblogger.org/probability_density_function_table.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_0c1387e6c58e4d72bd431cc21c3e2aac.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lizuseguwix/3282819349.pdfIn PDF document text
- https://6e345194-e688-4037-aa24-2ff230a16836.filesusr.com/ugd/ce9fe1_6a83d25787174c77a90899bb22bb265f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d7ce8f43-0e75-4a8e-99d0-5293071d9125/can_eating_gluten_free_food_make_you_sick.pdfIn PDF document text
- http://gelaleted.rf.gd/fuvaxaxatobedidar.pdfIn PDF document text
- https://s3.amazonaws.com/xutomoxu/empirical_approach.pdfIn PDF document text
- http://wiwazojugumume.epizy.com/caballo_de_troya_gratis_libro.pdfIn PDF document text
- https://0298dc5a-7924-4276-8279-06452a5288da.filesusr.com/ugd/b30cf0_9cd81a9bacdb45bf85b00cbe02870504.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/2d6b53f5-fb92-46d2-a286-40d7d785c70b/70300164765.pdfIn PDF document text
- https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_3ab3ea64e00647a78e710ec6e8ecf64a.pdf?index=trueIn PDF document text
- https://5bf49506-6ef1-42f8-8f90-7e3689255fd3.filesusr.com/ugd/8fe1bf_4517fe72bc9147c7b39f96cd3da5a618.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1e50d58c-327f-4d25-a039-7cc9b26adc26/nosumemifiri.pdfIn PDF document text
- https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_a4786ca9a98c4ddfa44eaeab5f645c8e.pdf?index=trueIn PDF document text
- https://bad3f395-1638-4667-b349-d6f934eeab49.filesusr.com/ugd/ed2d23_c7434699c75943b7bb8d5503287ba72b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/104eddd5-34a0-4b8f-be9d-8f5eab03a460/century_powermate_70_wire_feed_welder_manual.pdfIn PDF document text
- https://f8206d31-21c4-4aef-9da9-e4259ded718a.filesusr.com/ugd/c2bdac_84429292a551426ab85aa4df28db978e.pdf?index=trueIn PDF document text
- http://tasijojaludet.rf.gd/92340336317.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/754e9bde-c52f-42d4-a561-f3e29688636b/23671029908.pdfIn PDF document text
- https://4fe85328-8dbf-40e9-afa8-2c8d6ff8a9c8.filesusr.com/ugd/9c0842_c397f5dd838f451da5624400690e8535.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8e8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8E8 | 5324 bytes |
SHA-256: 42ee63c7be7fa67d2547d3448e2deb5114c69f8fb72405d1a499223bb5c44fb7 |
|||
font_01_sfnt_off0000fb08.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB08 | 10956 bytes |
SHA-256: 14039c7c886f5fc3509581381565e1857bce86589389a7929b5a2b26a117a3b8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.