MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document contains a heuristic firing for a link farm, with one prominent URL pointing to 'baarspo.ru'. This URL is likely used to redirect users to malicious content, disguised as a search result for furnace pricing. The presence of numerous external links and the ML classifier's high confidence score indicate a malicious intent, likely for phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=how+much+is+a+new+rheem+furnace PDF link annotation
- https://cdn-cms.f-static.net/uploads/4407062/normal_601723e80c2d5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4471488/normal_602b87e533738.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/01e6264c-017a-41c5-88f4-4c8241f6bb52/manilez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4895c8ae-1c06-4a01-bcd9-342cde27abdf/vuwowisemevopeli.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2942e687-a4c5-4a73-9260-d6192a1901e0/will_there_be_another_diary_of_a_wimpy_kid_movie_in_2020.pdfIn PDF document text
- https://s3.amazonaws.com/fajonubinomeder/15477867230.pdfIn PDF document text
- https://b56e6f12-3f4b-4b75-bc29-9585eb3fba71.filesusr.com/ugd/73f0dd_c403c9050d2e449ea228d7d7070abcb7.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/41424780-7497-45a2-9fe1-793657927dc8/pupojewizud.pdfIn PDF document text
- https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_5e6e020f6e8c4c9ebaf3e815599abea1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wewuxuviwar/s_chand_biology_class_9.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1223daba-bddd-45dc-845a-de97e795cc31/lagoradexusopafesosis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89a26386-d0ae-4a5a-88fc-86fa8ea907aa/xijovolezuv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c06d6e9b-84ff-43f5-918f-bc72c7e63bc3/literary_criticism_books.pdfIn PDF document text
- https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_2443f61115f9431694660921105b26c5.pdf?index=trueIn PDF document text
- https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_1f462801fe3c4832b47b97c33ffa7cf1.pdf?index=trueIn PDF document text
- https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_0974852af6ab4538a8a45699e2857bb4.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/numunenoji/91350015322.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eafc643f-941e-4c5d-aff9-9f3950e882e1/98963756437.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/80417baa-beb8-4cb7-bd3b-3964cf5020a1/how_to_care_diabetic_patient.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69ca66b5-1453-4167-b92f-904d443682da/41779786239.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000de21.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE21 | 5144 bytes |
SHA-256: 0fe7251995c2d0a0766d8cfcaf99163c525078c55d5a3572f5043c3fd553b1f5 |
|||
font_01_sfnt_off0000ef84.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF84 | 10936 bytes |
SHA-256: 119ee51f2cb52ba792a1509e6e161d325a477238023461ab66ef3470babb2a9b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.