MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/aws?utm_term=conversations+with+god+movie+youtube PDF link annotation
- https://cdn.sqhk.co/luzeginu/hayL7fF/vopepobi.pdfIn PDF document text
- https://cdn.sqhk.co/segidexu/jdiepUf/nakezegipabaseluzusedivu.pdfIn PDF document text
- https://cdn.sqhk.co/pivugisaxap/Libhghh/minecraft_servers_down_for_maintenance.pdfIn PDF document text
- http://geniusenglish.space/rizinojiqao73.pdfIn PDF document text
- http://ionatr.space/gubogivuvarexugamevp0o.pdfIn PDF document text
- http://sallehq.xyz/duracell_battery_charger_flashing_red6r8z7.pdfIn PDF document text
- http://palovedu.22web.org/22737899740.pdfIn PDF document text
- https://cdn.sqhk.co/buzaxelubot/ghVjeRN/war_commander_rogue_assault_apk_mod.pdfIn PDF document text
- https://cdn.sqhk.co/nigudovowa/hfqyjea/6367496091.pdfIn PDF document text
- http://iuts.space/battletech_technical_readout_2750dsx4h.pdfIn PDF document text
- http://fujopijur.iblogger.org/70330692534.pdfIn PDF document text
- http://about-central.com/75313527200lulb7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f468dd4f-3abd-4a84-b2bb-60137e7d351b/o_que_significa_direito_adquirido.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd39556f-e372-45d8-abba-3761bc7860a9/78130942308.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d4b40b0-0e0d-47a9-9cdb-c1a705062d06/86225850469.pdfIn PDF document text
- https://1c896d37-30d1-4b4d-9537-98f963aae812.filesusr.com/ugd/865d50_c3fd30bba50e4c41b267cb4a4a024d70.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/dc4e831a-21ca-4287-939d-14beb403f1e4/19835592552.pdfIn PDF document text
- https://b7af6bb9-01eb-4839-ab56-764651de4344.filesusr.com/ugd/2486b5_17926f9d619347cdb6d291d23ef86738.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b2fee7a1-751d-4d10-afea-4591cc00147f/41843337743.pdfIn PDF document text
- https://1ec9b6e7-17eb-4e1e-a994-ba5ce4cbdb7c.filesusr.com/ugd/d4a9d6_7e43d1cf1c89413ba4d43a0f0c66c199.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1d02dd9f-66ef-4e38-8db2-7cc2d8437f0e/sagib.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a933eaaa-a179-4aa3-ad78-67e6cce457b0/97512985551.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4c412809-d7aa-4877-99d0-1b2b9c51731c/what_is_the_opposite_of_inverse_matrix.pdfIn PDF document text
- https://6d706a39-1f93-4f1a-9423-caccf7e65e71.filesusr.com/ugd/69f91f_186938aebd804ae1ae5dd5d4d039263a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e167.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE167 | 5508 bytes |
SHA-256: 33b837606a4223e8f55ac342b0ec0c343424d266c537ee8fa5aeea4aa02e416d |
|||
font_01_sfnt_off0000f40a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF40A | 10372 bytes |
SHA-256: f90d445cea4b86aaf57e27e9d38e9d7ebde1c581726dc9eb001e24eed589aaae |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.