MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/strik?utm_term=how+to+open+a+speed+queen+commercial+washer PDF link annotation
- http://opt15.ru/chandramukhi_tamil_movie_tamilrockersgzmmu.pdfIn PDF document text
- https://mixosikopas.weebly.com/uploads/1/3/4/3/134383158/kajeroxolinewinot.pdfIn PDF document text
- http://evilcheats.fun/fajemufugepyrj3.pdfIn PDF document text
- http://hightrade.club/todevubudej0rs72.pdfIn PDF document text
- http://mirumumavetifun.mypressonline.com/anormalidades_espermaticas.pdfIn PDF document text
- https://pipabujul.weebly.com/uploads/1/3/2/6/132680817/fawawov-jupatenik.pdfIn PDF document text
- http://ninomut.sportsontheweb.net/augusto_boal_livros.pdfIn PDF document text
- http://albl.ru/how_old_is_jace_wayland_in_city_of_bones94i31.pdfIn PDF document text
- http://bawimip.sportsontheweb.net/92965492020.pdfIn PDF document text
- http://ledozikatiresev.scienceontheweb.net/konadinivogosezo.pdfIn PDF document text
- http://trickyturkey.com/mebidonuxojupanenuhmtks.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://nunavaxukozu.onlinewebshop.net/tiger_rice_cooker_cooking_time.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f5fab6cd-6497-487c-b42b-7ea28ac917c0/66676353838.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3cafc816-4faf-4f4e-9a6a-81b871630dad/where_is_love_in_the_time_of_cholera_set.pdfIn PDF document text
- http://zorijefugixor.atwebpages.com/jurnal_tentang_budaya_jawa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2ed36297-b79c-4db8-808c-96543aeec990/maze_runner_3_netflix_region.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ada0227-063a-4e7e-bedc-f388ace2f672/65611743119.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/972c15c7-faf4-42a3-be52-6286ace86251/whirlpool_duet_sport_error_code_f01.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02e4db27-c32e-4bd7-a547-93be330504c2/bexesuxopa.pdfIn PDF document text
- http://sagoralezerelo.onlinewebshop.net/cuisinart_coffee_on_demand_clean_button.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7cb44191-e3ae-471c-920f-6168b989d5c2/fifty_shades_of_grey_goodreads_review.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ef4f033a-bc71-4a81-b164-bc2a6911b313/pajor.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f40b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF40B | 5492 bytes |
SHA-256: c033b0dcfbfe2c2368b1234a90f13d5e9824532202899a284e49157ade49a081 |
|||
font_01_sfnt_off00010694.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10694 | 10012 bytes |
SHA-256: 75a682043909ecda8673234e90456d8bdbd2b511bb53c61eed8a4ba3e8ad28d1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.