MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and trojan characteristics. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm or SEO abuse tactic. One of the primary external URIs points to a URL that appears to be a keyword-based redirect, potentially leading to further malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/wix?keyword=strive+for+a+5+ap+statistics+answers+chapter+9 PDF link annotation
- http://fosibejag.iblogger.org/fesujiwanez.pdfIn PDF document text
- http://idealica-uficiale.website/2722848444ntlm6.pdfIn PDF document text
- http://kekebum.22web.org/track_business_expenses_excel_template.pdfIn PDF document text
- http://doordash.link/tubigaruximedelosubazuebgza.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://e432c3f7-acc0-403b-bc7f-1b8c16782643.filesusr.com/ugd/6a4899_c611b5e65df842e5959d468f1176ebea.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xakajoziwibi/kosuzutalejomawuv.pdfIn PDF document text
- https://s3.amazonaws.com/defujo/weather_report_in_cagayan_de_oro_city.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2344106c-9a0e-4ce8-897e-acfb9f619a63/wafunuzusegi.pdfIn PDF document text
- http://lotawovuvowuk.rf.gd/vuguwomaxadeg.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/59e13403-6413-40ce-805e-20e27cd299c8/what_is_the_meaning_of_time_management.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c4cc340-f84c-4ec5-bbfd-b26954b1cff6/presto_profry_dual_basket_deep_fryer_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/438704c8-e5f8-4791-ae63-fd77bde6cb47/is_a_certification_worth_it_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b484991b-90f7-43f4-8b14-1f9744f2796f/4549041564.pdfIn PDF document text
- https://f7690f66-1871-4559-97e0-239dee5b15da.filesusr.com/ugd/d2cc1f_43a4ae685db443b4baa726be6dfb31a9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/eb62c508-2c95-4edb-875a-812c42d2f7a0/14967071415.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/419bde23-618b-43c6-a741-f7b9bfe588d2/nursing_diagnosis_for_diabetes_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/866b261e-36d0-4b6d-9a5d-c5b4903f595a/traction_man_book_amazon.pdfIn PDF document text
- http://fewulagoxifi.epizy.com/87574482389.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f40ff053-da77-4c97-a225-c71b3ca866a1/sap_mm_online_training_videos_free_download.pdfIn PDF document text
- http://peparetixu.epizy.com/calidad_total_tqm.pdfIn PDF document text
- https://27475d5a-2981-497d-8cd5-0c310ef10f8b.filesusr.com/ugd/9cb927_b1fc1f74e1d043279ced273a23433412.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d206.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD206 | 5604 bytes |
SHA-256: 1aac6ee69a6d5ed5c82d39bc26f0449fd208495d45c0b0cbcc3ef48831135224 |
|||
font_01_sfnt_off0000e52a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE52A | 10036 bytes |
SHA-256: 3c927c0c7e6891c336685877be5ed5e75b8dd8588ab363601be117c421ebe5b8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.