MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9954
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/123?utm_term=ac+market+hack+apk+free PDF link annotation
- http://migriruy.ru/is_canon_good_for_videot4g0v.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4481154/normal_6036d857a0e72.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365536/normal_601125f89e396.pdfIn PDF document text
- http://uscreditcheck.info/how_to_cook_a_rib_roast_on_a_weber_rotisserie2n1ya.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4458412/normal_5ff7fc6572ebf.pdfIn PDF document text
- http://wordwild-store.com/rijodalavevoxewedoyaimh.pdfIn PDF document text
- https://cdn.sqhk.co/malofavu/4hdJibl/merchant_marine_ranks_wiki.pdfIn PDF document text
- http://wei-nmvc.com/7847486053hcka.pdfIn PDF document text
- https://cdn.sqhk.co/denirinodo/cIzkjgM/among_lock_ios_12_apk.pdfIn PDF document text
- https://cdn.sqhk.co/fosasukenum/Hhchfjj/5m_bell_tent_groundsheet.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370073/normal_6062394aca535.pdfIn PDF document text
- http://allostar.buzz/north_face_women_s_jacket_size_guideengs5.pdfIn PDF document text
- https://cdn.sqhk.co/noxisoture/0gdgghg/60948741301.pdfIn PDF document text
- https://cdn.sqhk.co/givogaduta/jciahf7/97616265487.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://8488b7ac-84bc-45ae-88ed-26841205fc59.filesusr.com/ugd/7cda3c_ca9f7c66abb542feb5b0e53ca1b22140.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wexoteluwag/once_i_was_7_lyrics.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/541c7715-1054-47de-bbbe-f372bb3c4654/idylis_chest_freezer_not_working.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/860fbaa0-79fd-4254-b627-d9524fcb08ad/1991_chevy_s10_alternator_wiring_diagram.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5bfd9de6-b0fb-431e-ada3-3f00ac90e30a/31413167067.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5bb2a6f6-ccbe-49e6-a71c-b5e034a6752d/what_is_the_lathe_of_heaven_about.pdfIn PDF document text
- https://s3.amazonaws.com/kikunojulejuj/garigotak.pdfIn PDF document text
- https://s3.amazonaws.com/woneketelak/gijaloletagepimiridaliv.pdfIn PDF document text
- https://s3.amazonaws.com/garorowa/large_craft_foam_sheets_michaels.pdfIn PDF document text
- https://s3.amazonaws.com/pujirageg/what_is_second_order_derivative.pdfIn PDF document text
- https://4b3b4da4-1145-40fd-8a04-0ac29766dab0.filesusr.com/ugd/6c6203_074a204775bc4d438107667b02ef1fef.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b004569b-dc62-4cf9-8807-f192e7867893/programa_de_honores_a_la_bandera_inicio_de_ciclo_escolar.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fdf4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFDF4 | 5100 bytes |
SHA-256: 799d18d0bc439fc7d884df7b4378b155b1ff40ef17fa97c7fc04ef989c0b70bb |
|||
font_01_sfnt_off00010f1e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F1E | 1800 bytes |
SHA-256: e9a5a1f6ed95b1e3669933bb00002ad32a1708c3e0b735191cad5e02368a6c7d |
|||
font_02_sfnt_off000117ac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x117AC | 10724 bytes |
SHA-256: d33be9b9e388a3e4039f3e2a4bc0ab5b94b74970b159b1cfec81c12b89798733 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.