MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a link farm. It contains numerous external links, including one pointing to `https://baarspo.ru/strik?utm_term=how+to+write+an+argumentative+paragraph+step+by+step`, suggesting a phishing or SEO manipulation tactic. The presence of multiple PDF links on disposable hosting further supports this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://baarspo.ru/strik?utm_term=how+to+write+an+argumentative+paragraph+step+by+step PDF link annotation
- https://cdn.sqhk.co/sibamoxa/eSDEjjD/3094823878.pdfIn PDF document text
- https://cdn.sqhk.co/fudikuzi/Btv4jiM/join_the_crowd_appeal.pdfIn PDF document text
- https://cdn.sqhk.co/burexewejam/bjdjfgh/waguketilamamepapezojab.pdfIn PDF document text
- http://izzzaaa.space/blood_bowl_2_trophy_guide61oqb.pdfIn PDF document text
- http://teplotronic.ru/zujusimaroz6yjqj.pdfIn PDF document text
- http://wiinorama.space/past_tense_worksheet_for_grade_3sw6wp.pdfIn PDF document text
- http://tameeniraq.com/xidinekatewobanefexedivex7iun9.pdfIn PDF document text
- http://sodahq.pro/pezeruduvuzemujuwofokog4h7x7.pdfIn PDF document text
- http://huaweistoreukr.xyz/lodamalovilirobasabosigilvr.pdfIn PDF document text
- https://cdn.sqhk.co/koxajavu/cq4KhbW/73169226341.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://3e1ae61b-6b68-46dc-8a90-d1c7a5b9f91c.filesusr.com/ugd/b8bbd7_d70eea02e4d34d9d8f5a75482e55a34d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/55c6fa2d-8e4c-4236-9c31-7841854a2bc4/vesezevufebegik.pdfIn PDF document text
- https://11484d69-1612-41b9-9199-165df1f08223.filesusr.com/ugd/e2f197_aff2b8012b9e4140944efc3ab294e5d2.pdf?index=trueIn PDF document text
- https://22520ec4-2132-45a5-98b8-54db1b71d3ea.filesusr.com/ugd/b33b96_5e531f94a25d4507bde120d38d0c7799.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/27719bf6-6783-4851-8e84-31a926726a6d/79850714452.pdfIn PDF document text
- https://cfc603e6-7cd4-4c42-812b-9722deb80ae4.filesusr.com/ugd/0e9fc2_75ab30753ca14967a49ef26ad151ef50.pdf?index=trueIn PDF document text
- https://2eda13a9-9e0f-47dd-bbfa-a9a5028a3314.filesusr.com/ugd/61c57f_82853be9c20049e9abcb605ab4c78bcc.pdf?index=trueIn PDF document text
- https://2e81f42f-67f9-46a9-89e2-a5f3ab3b03ee.filesusr.com/ugd/f138f5_597d9b80afae48a8a0da8212d1a48cb3.pdf?index=trueIn PDF document text
- https://f730d15c-1921-46d2-b6d4-288333e40990.filesusr.com/ugd/e2c223_ce291d07102f4d548408a7d4fedf420b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3cd041ab-8ed6-4c02-8129-548c67fc8503/dream_yuga_110_mileage.pdfIn PDF document text
- https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_75da7e67eed9465cb1afad081aba4257.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f6f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6F6 | 5556 bytes |
SHA-256: d5911f7b8ea69742481165773ba2c3775b1049a173193b3f0f6dab9a0a46cf0c |
|||
font_01_sfnt_off000109c8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109C8 | 10156 bytes |
SHA-256: 7f5d422de61c60aaa62a11f4401257ca84c96164932273780c7a9b78f7044fa8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.