MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains multiple external links, with one specifically advertising 'Ares virus mod apk 1.0.7 unlimited money'. This, combined with the heuristic 'PDF_SEO_LINK_FARM' indicating a large number of external links, suggests a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support the malicious nature of the file.
Machine Learning
- Nyx PDF Classifier malicious score 0.9873
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trafffe.ru/123?utm_term=ares+virus+mod+apk+1.0.7+unlimited+money
- https://gipulafu.weebly.com/uploads/1/3/4/4/134442702/kaner.pdf
- https://cdn-cms.f-static.net/uploads/4377935/normal_5f92675948330.pdf
- https://bugupoxe.weebly.com/uploads/1/3/4/8/134850066/votipatigoji.pdf
- https://cdn-cms.f-static.net/uploads/4366347/normal_5f99314120c1a.pdf
- https://bisudika.weebly.com/uploads/1/3/4/3/134366448/bawasezanefidan.pdf
- https://xivenisulebitok.weebly.com/uploads/1/3/1/3/131378814/sojaxom.pdf
- https://kasugokadudibuk.weebly.com/uploads/1/3/4/7/134740653/5295034.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/0243d0ca-17d8-42f1-b062-69a011a77c64/application_vnd.openxmlformats-officedocument.spreadsheetml.sheet_does_not_work.pdf
- https://uploads.strikinglycdn.com/files/6e9f744c-0b86-404f-8538-795b7b66b899/kepag.pdf
- https://uploads.strikinglycdn.com/files/035a4c24-b7ce-471f-b35f-2b99da7bf5a7/sifedebetebu.pdf
- https://uploads.strikinglycdn.com/files/94dbf072-42a3-4ed6-bf8f-b0d8856f3539/belokilu.pdf
- https://uploads.strikinglycdn.com/files/5cfc21c6-b808-4d32-961a-cf515d9dd003/wakoxuluzomanudab.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdfe19f3de5e49b52a63ab/1606286873920/bell_tv_guide_niagara_falls.pdf
- https://uploads.strikinglycdn.com/files/2788bc2e-7c37-4673-b2d5-f3414f990322/75253470202.pdf
- https://uploads.strikinglycdn.com/files/40673579-2c8d-4966-bebc-e321dd2e9ece/21040228667.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ce61.bin372feba54e913e349f4dd8d7551d5fee64cdacc5e311cbc5bd72e77db02890df |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCE61 | 5508 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.