MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. It contains a large number of external links, many pointing to disposable hosting, suggesting a link farm or SEO manipulation tactic. One of the embedded URIs, 'https://nipisod.ru/award?keyword=socializacion+y+aprendizaje+social+pdf', is of unknown reputation and is considered a primary IOC.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/award?keyword=socializacion+y+aprendizaje+social+pdf PDF link annotation
- http://onsideball.info/are_they_making_a_harry_potter_8zop2v.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375521/normal_5fd5fdc74f90c.pdfIn PDF document text
- http://investorlands.ru/mevidenir3yrtw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478669/normal_600dbfcb96743.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/805b0bf7-f3fa-45fc-bd39-0de474e620d8/what_skills_do_i_need_to_be_a_good_public_speaker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/685379de-d70e-423b-b0f3-fb890bf7ab54/arguing_about_literature_a_guide_and_reader_3rd_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d0a2280-0ad9-4084-ae57-2534aa413e28/why_isnt_my_frigidaire_dishwasher_drying.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2a1c1f1-3e09-4e5f-9f3c-31f9545926b4/mamiya_rz67_handbook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/28e519df-45aa-427b-89c1-d100246eff05/48837410127.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8b249416-9f6c-4d08-bec2-ca85c161202b/nukumiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7761be95-99e9-443a-ad6e-6395f9c4d52a/luwenexotenu.pdfIn PDF document text
- https://11f44e1d-c86f-4be6-baa1-90970e7c24f5.filesusr.com/ugd/a298ce_92c2b57b6d6942caabd3c7708f41306b.pdf?index=trueIn PDF document text
- https://0bdb67af-4c57-4a6e-9706-714cc80719f5.filesusr.com/ugd/fc840b_fb7528299ee0476b9b1cfef941ff0ad2.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4738b567-3e46-4b52-9d1b-93e4ddb07376/robin_hood_castle_nottingham_prices.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc89baa6-78a5-4730-a972-55d00a971dda/97314574316.pdfIn PDF document text
- https://d4508431-0eee-4913-ac2a-2ec907ed9b18.filesusr.com/ugd/12daa7_7f450641b65b43c68c42c290c5272810.pdf?index=trueIn PDF document text
- https://ca7c05ed-d233-4774-9cf9-08ff86aa6c73.filesusr.com/ugd/b42fd6_49cde0c8af5b40949eb9094f0edb1c4e.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/16904808-b2d0-4aff-83ac-eab1ed71423b/tokezilolukufe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6e3cd0d5-f36d-4489-9791-ab19412e4c71/64268062978.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d073.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD073 | 5188 bytes |
SHA-256: 2a9f65bfc7922314f02422586f8a0d1dd42718e30671df0d13bfb63eac22a896 |
|||
font_01_sfnt_off0000e21e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE21E | 10792 bytes |
SHA-256: 1c2d648efb0a887225b336f922055a07b413a80d0ef6e3ab7b98c630b2f64dc1 |
|||
font_02_sfnt_off0001050f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1050F | 4324 bytes |
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.