MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by both ClamAV and an ML classifier. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm designed to direct users to potentially malicious content. The presence of embedded URLs and the heuristic 'PDF_SEO_LINK_FARM' indicate an attempt to leverage SEO tactics for malicious redirection. While no scripts were explicitly extracted, the nature of the link farm and the overall detection suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/123?utm_term=straumann+impression+coping+guide PDF link annotation
- https://cdn.sqhk.co/fuvopone/bqiihil/moon_patrol_online_original.pdfIn PDF document text
- https://zaximasuxudaris.weebly.com/uploads/1/3/4/5/134590642/fe860304dee.pdfIn PDF document text
- https://cdn.sqhk.co/winogolelog/azYjgjd/wekufewu.pdfIn PDF document text
- https://jegobagugixados.weebly.com/uploads/1/3/4/8/134858953/fe5d079bf9c10c9.pdfIn PDF document text
- https://felogenapugiro.weebly.com/uploads/1/3/5/3/135327705/zibuwubuwuk.pdfIn PDF document text
- https://xumizobizuzu.weebly.com/uploads/1/3/4/6/134688834/toxadij_pezezegifuperi_pogoru.pdfIn PDF document text
- https://ramilelajebow.weebly.com/uploads/1/3/4/6/134647205/mudaja.pdfIn PDF document text
- https://danegatazi.weebly.com/uploads/1/3/0/7/130776269/2350919.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://5c2cca0d-3a4e-48b0-93bf-8ac6c0c026cb.filesusr.com/ugd/271e65_1e780e55bf7b46d0b44d7b822dfbd8c6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c54fe3ed-f0e1-4c51-b3b9-5d85538195a5/wixurivejolanuxut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86daaaef-4ef0-4646-9164-c4027b8665e8/metro_2033_redux_chapter_7_bug.pdfIn PDF document text
- https://fa0867c9-8cf0-46f9-bfae-aad8e49c21f3.filesusr.com/ugd/cdba2c_bf24ab51b2fa4d84949c3063f3646a1b.pdf?index=trueIn PDF document text
- https://f7cac2f2-528f-490f-9bef-cb2448a877de.filesusr.com/ugd/529ba0_96fc5003389f4d6380e112bf7f2d48d8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/acddccb8-68a7-4236-b93a-2e024a5e51da/2005_honda_rancher_350_carburetor_removal.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9c835cf1-d359-4659-8c4f-370fc87496fd/war_horse_trailer_music.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b1fcaccf-bc2f-4fa3-8342-bea67e2e3955/why_is_agenda_setting_important_in_public_policy.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ceab8757-57d7-44b1-873d-9089de8b4914/blank_venn_diagram_template_3_circles.pdfIn PDF document text
- https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_8d8321b7f504466fa0a8fb4696fb4c0f.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/04280232-d3d8-4823-864d-997de11b564c/jazozofamofar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3382bbf2-95ec-4b2e-9611-f5a851508e4b/how_to_determine_the_age_of_sedimentary_rocks.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d740.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD740 | 5464 bytes |
SHA-256: 5df4f2b21aa6e1e6a206d6aa4d6d582100c6cbe53fc5586f913b42f2b8417b27 |
|||
font_01_sfnt_off0000e9b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9B9 | 10952 bytes |
SHA-256: 4cd7d4cba9ec97ca4345310a88b48e93228bf155eaaa163fb79445334a29639f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.