MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF file contains a large number of external links, many pointing to other PDF documents, which is indicative of a link farm. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or distributing malware. The primary IOC is the initial URL which likely serves as a gateway to the link farm.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=richard+tarnas+cosmos+and+psyche+2020 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4460709/normal_6001ead6776cd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370068/normal_6026da3cbcc22.pdfIn PDF document text
- http://majusenise.sportsontheweb.net/pipexulenuzuvatila.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/45e82a2c-15ef-4ef4-b04d-df8eb2036218/60895840691.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1452a434-727a-43c5-8300-2424b8df1ec9/28045677412.pdfIn PDF document text
- https://s3.amazonaws.com/xukanomarexumu/rotutiligonulugoniwuvo.pdfIn PDF document text
- https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_7ab319e0220a41a093cff296849726c4.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/farokof/domotuxewamubefobofabodo.pdfIn PDF document text
- http://milebulijulami.onlinewebshop.net/aviation_safety_management_system.pdfIn PDF document text
- https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_94be267aabe649e6b79d0912868d3aca.pdf?index=trueIn PDF document text
- https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_39565eb7f3c54705b0415f3340f2c188.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/91988fc4-7cfe-4367-9289-7ee1e94dc28e/baldurs_gate_2_enhanced_edition_jaheira_romance.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/67b8cc32-57c3-4137-afde-d3c87bf9d25f/how_to_troubleshoot_a_tankless_water_heater.pdfIn PDF document text
- http://sawesupunozigiv.atwebpages.com/tu_eres_digno_de_gloria_danilo_montero_letra.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75a4310e-27d4-4a3c-b50e-dfbe2f966ffe/list_of_spider_man_comics_in_chronological_order.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/be0d6932-f963-47b9-baf1-46365b037034/gopro_hero_4_session_manual_svenska.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f1f123e4-65bb-4e3d-a270-150f71a11a6f/3rd_grade_cloze_reading_passages.pdfIn PDF document text
- https://s3.amazonaws.com/xilasisefi/64026535140.pdfIn PDF document text
- https://ec451167-49e0-489e-a150-d7dc0ecf9264.filesusr.com/ugd/fe0276_e9c580d8c16343798256880a7eeafdda.pdf?index=trueIn PDF document text
- http://nebojemesiwi.atwebpages.com/mla_bibliography_example.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b2aefc2-1b5f-40a3-9ae6-29b9e9dfb8ef/can_multiple_macs_backup_to_time_capsule.pdfIn PDF document text
- https://s3.amazonaws.com/lovetijif/power_wheels_barbie_cadillac_escalade_charger.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f493.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF493 | 5664 bytes |
SHA-256: 456ca679197117a4b017d5668ca0d3ee231bc9a2322f651a29f929bc8d325550 |
|||
font_01_sfnt_off000107b6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107B6 | 10740 bytes |
SHA-256: 0e7f14d48c10d32a563dc767d18a6320a0b81191c64b15fbda8f54d3ac7e346a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.