MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are to suspicious domains, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent. The embedded URL and the heuristic PDF_SEO_LINK_FARM indicate the document's primary purpose is to redirect users to potentially harmful websites.
Machine Learning
- Nyx PDF Classifier malicious score 0.8239
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://traffset.ru/aws?utm_term=mathantics+algebra+worksheets
- https://dusuwepi.weebly.com/uploads/1/3/4/5/134589125/2326218.pdf
- https://dajexuxeguse.weebly.com/uploads/1/3/4/8/134859846/lotatituwupuv.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f10b1638-1579-48b7-9ba0-3158800fd4eb/gipuj.pdf
- https://uploads.strikinglycdn.com/files/e5830cd2-ca37-45cf-b667-a91cdea55142/silica_gel_is_polar.pdf
- https://uploads.strikinglycdn.com/files/87f419f1-c12d-4b31-b6bc-e1888f676664/daddy_sylvia_plath_analysis.pdf
- https://uploads.strikinglycdn.com/files/feb2866e-5c1c-4633-9cae-c802912b0be0/68343293188.pdf
- https://uploads.strikinglycdn.com/files/7aa64e96-be3f-4175-9b6a-94bcce406a95/kepox.pdf
- https://uploads.strikinglycdn.com/files/ae07c2ee-1410-439b-8945-30d29d3288ab/agnus_dei_violin_sheet_music.pdf
- https://s3.amazonaws.com/baxekojojexusol/gagujozu.pdf
- https://uploads.strikinglycdn.com/files/470d1deb-67f8-4e49-80ee-0ea7a4474f15/8236291597.pdf
- https://uploads.strikinglycdn.com/files/904bbb11-66bc-4685-b4fd-fce25ab41a01/derivative_worksheet_doc.pdf
- https://s3.amazonaws.com/ragejufa/tutuvutuliporobaj.pdf
- https://uploads.strikinglycdn.com/files/35101fba-38ab-4d19-ad8d-1d2f32b24784/tx500e_thermostat_manual.pdf
- https://uploads.strikinglycdn.com/files/74262884-d642-4f27-9bbd-38fbbdc61cc7/3601444406.pdf
- https://uploads.strikinglycdn.com/files/afe6f7dd-7f41-4afc-b353-f472f458272e/oregon_speeding_ticket_letter_of_explanation.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ece4.bin6865f09653ef8d2c5357367fbaec6e324771670e0696d6c7642d002e6fc572c4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xECE4 | 5364 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.