MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/123?utm_term=abstract+nouns+worksheet+grade+7 PDF link annotation
- https://mawobomogagot.weebly.com/uploads/1/3/4/1/134109187/xuzuzer.pdfIn PDF document text
- https://nipibodofabujid.weebly.com/uploads/1/3/4/2/134265940/cccb699fbd7.pdfIn PDF document text
- https://senemoribut.weebly.com/uploads/1/3/4/7/134703027/sujum.pdfIn PDF document text
- https://barurusijibipek.weebly.com/uploads/1/3/0/7/130740419/fojetapanofutajap.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/e7ecb37a-5081-483b-9a37-14a4c7bc680f/how_many_hours_is_the_original_final_fantasy_7.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b092462-25dc-4b52-8350-55e6217887a0/65336395759.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a34cf5b-fba6-4897-ac43-5d166533a12e/tamigerunozi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1ae5579e-4925-4656-bd68-a3933f48112a/desagopu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eedde8dd-f406-4d46-88f7-729b50373dbb/80904731361.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6314b89f-816f-46b8-8414-d87516a9979f/vugekufix.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b860bff9-9693-43f9-90d7-555678e01d67/13127530288.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9db7cc36-a2cf-4951-b998-a5433e9fa5d3/pakuduvedidonubaxe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c7a93a5-1556-4b12-9ddd-fbd0dd809bf4/jamufawebomemolalapumo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/436245c4-4c71-4afd-9bbd-59785ef5b5bd/23813960357.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/57bbf68f-d01c-4338-9ddf-078e03461c9a/cooking_merit_badge_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3fe0d18c-3826-4c16-bea3-41c90b0cde67/200697299.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4cdc74e-ef2a-44d3-9326-57150efe9074/45829495031.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/738c29ec-6f7f-4edf-9fa3-ee04bb9057b0/17691494989.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca2a57f8-3c7f-42e3-b891-1921aa93b768/83335379658.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b59eff47-33d9-4677-90e2-76e96520619f/63442485542.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c71264af-3454-46bc-bdff-daa533d985ef/20200063103.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/221c027e-b4fd-49eb-80ad-c4652625f949/sat_math_equation_sheet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1bffd867-f1d8-41a8-8228-e9129c10c2e6/lefizet.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c8829db-cf5c-4d71-a2cc-9506abcd45f4/death_be_not_proud_by_john_donne.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1ec1bbc9-8098-42a1-a36e-1f1bed5915dd/what_are_the_influence_tactics.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef96.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF96 | 5368 bytes |
SHA-256: 0e26419915c36e58d68e438f7aa4cad265b67e570a059fb863b50c94ee2dbbc6 |
|||
font_01_sfnt_off000101d7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x101D7 | 10692 bytes |
SHA-256: 310398008e47ea4675976d6e29de4b35eb356683865c5a4970e9dd2c4e847417 |
|||
font_02_sfnt_off00012645.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12645 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.