MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.7994
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://resalured.ru/award?keyword=swot+analysis+report+pdf PDF link annotation
- https://cdn.sqhk.co/xarozowuzosa/fKigjbG/off-_road_russian_truck_driving_simulator.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4377102/normal_5fee67f366b73.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403820/normal_602789a3112ff.pdfIn PDF document text
- http://tewazezila.66ghz.com/android_actionbardrawertoggle_change.pdfIn PDF document text
- http://opensoda.pro/gajoxasazotopifuajrg8.pdfIn PDF document text
- http://cocobeautybar.ca/901748286679jdbm.pdfIn PDF document text
- http://punegasu.22web.org/list_of_transition_words_in_spanish.pdfIn PDF document text
- http://gumovuf.22web.org/taxinexejo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385647/normal_6058dc34395bc.pdfIn PDF document text
- http://capridigi.com/xesinari4r8y6.pdfIn PDF document text
- https://cdn.sqhk.co/razefudixid/YoFhcKg/syberia_3_xbox_one_bugs.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://dogamesesokuj.rf.gd/ashp_guidelines_on_adverse_drug_reaction_monitoring_and_reporting.pdfIn PDF document text
- https://fd7a53fe-11c1-4e60-83ad-ac1bb997268f.filesusr.com/ugd/5cf23b_86a7ff2173734b81a9a563543e7d149e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/daselex/38680866781.pdfIn PDF document text
- https://s3.amazonaws.com/zulezov/boluvawo.pdfIn PDF document text
- https://4a31e3f8-49e3-4331-b1a9-c0bb7a6b9dbc.filesusr.com/ugd/599f1c_0cf52a486c1148e599af9d4ed37a38c4.pdf?index=trueIn PDF document text
- https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_d442f0a3d9b84a0cb175d65179462452.pdf?index=trueIn PDF document text
- http://vitorozakosi.rf.gd/vamalegalazaresuvux.pdfIn PDF document text
- https://s3.amazonaws.com/dutuzanob/28262965508.pdfIn PDF document text
- https://s3.amazonaws.com/samopakamefap/haunted_movie_ringtone.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000112c5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112C5 | 5332 bytes |
SHA-256: 8ebaa67722ebb5cc26921921c771c37df175abf1275e68cb43554405325fb497 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.