MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dugedepap.ru/123?utm_term=other+liabilities+in+balance+sheet PDF link annotation
- https://cdn-cms.f-static.net/uploads/4416510/normal_60385bbd65975.pdfIn PDF document text
- https://cdn.sqhk.co/wufotubi/iOhiZRw/96544975720.pdfIn PDF document text
- https://cdn.sqhk.co/lirebirab/iOHtzih/actualit_conomique_maroc.pdfIn PDF document text
- https://cdn.sqhk.co/wireriduwude/jjheVmK/crack_bones_massage.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4405654/normal_5fc56d714005a.pdfIn PDF document text
- https://cdn.sqhk.co/woxipepevati/xaoFVgf/crowders_mountain_state_park_pinnacle_trail.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387808/normal_6005448d29552.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4484118/normal_60077be032887.pdfIn PDF document text
- https://cdn.sqhk.co/muligumixe/fGBgfjg/bacon_escape_2_all_characters.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/minaxigevani/historias_biblicas_cortas_para_nios_cristianos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86a3af4e-9810-43fe-a962-3ec2ec416743/christmas_writing_activities_for_6th_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a0a9b24b-ab0c-46d8-b72c-c432e3db5394/61082863624.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5dd7d9a6-6c65-4fa0-96db-fb5223450719/business_ethics_concepts_and_cases_7th_edition_ebook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2614d62-c8a4-4734-ad28-6da794dad796/what_is_qms_subwoofer.pdfIn PDF document text
- https://s3.amazonaws.com/xovajukoxin/piriformis_muscle_pain_after_sleeping.pdfIn PDF document text
- https://bb55feb6-a0c4-48ae-8f72-aea2c45912f8.filesusr.com/ugd/b9801a_e2ac8451185d4d08b30efb92278a46f1.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/luworizesupox/wakovuduzaguwon.pdfIn PDF document text
- https://s3.amazonaws.com/jazofi/gefowakosobug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c40f333b-99b7-4ed6-9033-01c406efc596/65480447355.pdfIn PDF document text
- https://s3.amazonaws.com/rakabexozu/baby_books_online_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/644429a3-3cfb-4287-8730-12107cf88e28/pipe_saddle_layout_tools.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/581e4199-0930-405b-ba97-bbc351401095/4240322025.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/21c1407e-6fa1-4e85-abfd-106b6c8398eb/short_moral_stories_in_hindi_for_class_9.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a5fc8e1f-087a-4645-b506-3075cf218288/is_the_new_mustang_an_suv.pdfIn PDF document text
- https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_c23ae0ab3e4f4c1c91dabf393b9f8286.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fb11.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB11 | 5052 bytes |
SHA-256: ac0510a867b48750b7b06e3579518d8283b5cfb776613ed439b2e0f1546892b2 |
|||
font_01_sfnt_off00010c2f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C2F | 10628 bytes |
SHA-256: 4c18351e13f1fe498231fce21bd134ab902459bf32f005427702568d914d25f6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.