MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/wix?keyword=leon+blanco+en+peligro+de+extincion+informacion PDF link annotation
- https://cdn.sqhk.co/remezebona/jcgh9iC/battery_tender_charger_harbor_freight.pdfIn PDF document text
- http://wixiziz.iblogger.org/96695903685.pdfIn PDF document text
- https://cdn.sqhk.co/mezewimaxus/9hahjgd/gaming_wallpapers_for_pc_free_download_hd.pdfIn PDF document text
- https://pawunotapi.weebly.com/uploads/1/3/1/4/131408062/mugekepar-wekupufiwuxot-nukotedefawa.pdfIn PDF document text
- https://tupirusu.weebly.com/uploads/1/3/4/7/134702138/8877311.pdfIn PDF document text
- https://faliroralomi.weebly.com/uploads/1/3/0/8/130874474/502671.pdfIn PDF document text
- https://cdn.sqhk.co/jowapezo/jajeEie/nimepalabosiwujesaneg.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jupevuxirapi/herbalism_guide_1-_300_vanilla_wow.pdfIn PDF document text
- https://s3.amazonaws.com/bolovopizonuki/how_long_is_the_bar_on_a_stihl_ms170.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b767d46-f1a8-405a-bac4-b366eead1fae/vogetajarunazekafogubip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e2ef584e-2c8e-4d2d-a5cf-a046b9d09db8/how_to_be_a_certified_pediatric_nurse.pdfIn PDF document text
- http://zexizel.epizy.com/99140475407.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/325eeae0-3934-4772-a607-6e480f5bcbf9/92908840959.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bf941a09-3339-4bbb-8294-23745ad1dd59/sofetafovixedovizezetevi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ba69a2e7-d20f-434c-acad-7fb9ceb45436/98374911173.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/683c4cbf-0477-4cc6-80d1-0da118a3bd40/advanced_dungeons_and_dragons_players_handbook_2nd_edition.pdfIn PDF document text
- http://rebokomixuxoj.epizy.com/50780845455.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8cd86c74-f686-476f-8f61-d08a9fae30b3/vowuzepomase.pdfIn PDF document text
- https://s3.amazonaws.com/tosevud/14161389821.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3081d94b-a437-46d3-9dd3-2e5350008317/my_samsung_washing_machine_is_not_draining_properly.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e0a39c2b-53d7-44d3-a71e-2abdf6b5335b/how_to_convert_cal_to_cal.pdfIn PDF document text
- https://s3.amazonaws.com/wajufifenoxuj/79255747538.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000111c4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111C4 | 5444 bytes |
SHA-256: 9cb9d5ae0601a203836639e2447d51ae3884bf88bffac6f6b5003e5dbbeed85a |
|||
font_01_sfnt_off0001243e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1243E | 12224 bytes |
SHA-256: a38e0030b3b6997c47a697123b8534f0e3904627a8899bf21c3b0be9d22a3e13 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.