MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vilenefex.ru/strik?utm_term=causes+of+urbanization+in+zambia+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4412174/normal_60320272b535c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410447/normal_60647a3064a4c.pdfIn PDF document text
- https://vitiwujujoter.weebly.com/uploads/1/3/4/6/134659282/5715910.pdfIn PDF document text
- https://sevimuxeso.weebly.com/uploads/1/3/0/7/130739978/katinuxigo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481985/normal_6029805d665f8.pdfIn PDF document text
- https://jotelozaji.weebly.com/uploads/1/3/4/4/134484012/9589572.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8f815e53-a635-4c61-88e1-2208c8b19c3d/what_is_classical_statistical_theory_of_public_administration.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f2544f6e-1db6-4412-a9c9-92f1e5aae33d/ford_3000_tractor_steering_parts_ebay.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01f1d0e2-e509-43cb-b666-0b6910f25f4d/5077953610.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c53cc2f3-8f0f-42fb-ad01-2886b0c07c06/what_is_the_best_app_for_learning_chess.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8518805b-f1ee-47d6-99c4-c1db3de063ec/lolovuwodejaf.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/29c8e358-e9db-4cf1-a3df-0d5a5303e162/64948479106.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2d29fbad-b0fb-4b52-b133-250163ce3c47/best_book_to_learn_sql_for_beginners.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/70c1de01-3791-40b3-8220-4ed63777ab07/85553447922.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ca81f0fb-97a5-47e2-bf35-c8de06b42aa3/58740140410.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3ee9f040-3baa-404a-a5f1-52e671f45d78/10060429494.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/00d90670-8409-4095-904a-e6664207d3d8/how_to_reset_keurig_2.0.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/89322ba3-aa21-4ef5-9452-35d1bf58db53/60066135.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/23dfc073-f3fe-4b3e-84dd-302d1294c35b/voxexemexapexumogu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/54ade0f5-6817-4374-8a1d-df1f7aa91566/winnie_the_pooh_book_complete_collection_of_stories_and_poems.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c29f4904-eaef-485b-a8af-ac81aa1cae2f/beats_studio_2.0_wired.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/18afdefc-97ca-4c5d-a5d6-c7f13e81845f/25253704812.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5be0313c-f2fa-4dfa-8a3c-717eeaa38621/95900001137.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02fc398f-d2c3-436b-865d-e318b71f93a9/commonlit_test_answers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f418.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF418 | 5252 bytes |
SHA-256: 95025f6dfec5c3ae1251c47dcc7357bf32003dc8685611c2f1671bd3d20f7777 |
|||
font_01_sfnt_off000105da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105DA | 10752 bytes |
SHA-256: d1bec934be2c78ffa003b76d41f5badb4121df17e017ef8a4f71d2ea99f9448f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.