MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=easiest+expert+plus+song+beat+saber PDF link annotation
- http://psyhologrzn.ru/itil_v4_foundation_certification_study_material1h45s.pdfIn PDF document text
- http://rusakova.space/real_love_test_game_online1mf9n.pdfIn PDF document text
- http://ecoservice-vlad.ru/xuvamafadebimibifozeloxa2n3lg.pdfIn PDF document text
- http://esparks.ru/zativigosa220bb.pdfIn PDF document text
- http://wersita.space/palozojajafonanuvosekeca0kz.pdfIn PDF document text
- http://hydrofthol.space/bitiwegurojajokasei4pcy.pdfIn PDF document text
- https://cdn.sqhk.co/miloniwuwave/giU6k1k/slingplayer_free_for_phones_apk.pdfIn PDF document text
- http://upgrade4me.com/posizifaralipedid4tpu.pdfIn PDF document text
- http://itgermany.net/how_to_set_plug_in_timern8pa2.pdfIn PDF document text
- http://circleshtang.xyz/how_does_time_relativity_work_in_interstellar18k4o.pdfIn PDF document text
- http://blockingscenery.com/how_to_write_a_cv.pdf_free_downloadsvn8n.pdfIn PDF document text
- https://cdn.sqhk.co/towinomer/gijeiaK/brazil_women_s_football_world_cup_wins.pdfIn PDF document text
- https://cdn.sqhk.co/zapusukajev/bgi4jc9/highway_to_hell_movie_poster.pdfIn PDF document text
- https://cdn.sqhk.co/kivipemo/gciihgY/luzelak.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/91ee0a93-94d6-466a-bee5-5b027a31e3f7/netbeans_java_in_file.pdfIn PDF document text
- https://d1ced4a1-fa29-4c66-b583-77209f32159a.filesusr.com/ugd/c88d8b_14c1ec26258d4a22bee391092cfe2f8b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/797fcc38-7313-4b3a-a466-3777197ce7f2/what_topics_are_in_cell_biology_gcse.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/abda047a-024f-471c-b0fb-3706bb6f82f7/82974688408.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3463a22f-801a-4d12-ac36-4131a8fb5686/is_cadillac_cts_a_reliable_car.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/45c3d82c-81de-4242-9aa9-95f6ff4cf119/63376530462.pdfIn PDF document text
- https://c0e8410b-c394-4b36-8083-179878a46647.filesusr.com/ugd/d4b1dc_1a83f662f63040e2b1d9861cf956f9ae.pdf?index=trueIn PDF document text
- https://c46c713f-5e69-4c64-aad4-d86f29440f76.filesusr.com/ugd/957c7b_f0d78ec2744944f7b721ac496ab58362.pdf?index=trueIn PDF document text
- https://21d44941-995c-48b9-956b-8145330e20d5.filesusr.com/ugd/577b75_d3aa8e29d44e4244be567d065ff39546.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/d7c3835b-f3b3-415e-999f-afc3db7edb2e/members_mark_fire_grilled_chicken_breasts.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012459.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12459 | 5152 bytes |
SHA-256: 830d97747b23deed6720c4c357af2e50e09e00a9dedd2552bc8869cbcff123d0 |
|||
font_01_sfnt_off000135f0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x135F0 | 13348 bytes |
SHA-256: 501616ac146774f628e9bd907fe38e299bf4eb38e389ea8becec8c1e77b32600 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.