MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains numerous external links, many pointing to disposable domains, suggesting a link farm or SEO spam operation. The document body, though heavily obfuscated, includes a title related to 'Realistic group conflict theory definition' and metadata indicating it was generated by wkhtmltopdf, a tool often used to create PDFs from web content. The presence of external URIs and a high ML classifier score strongly indicate malicious intent, likely phishing or malware distribution via these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/strik?utm_term=realistic+group+conflict+theory+definition PDF link annotation
- http://gudokav.sportsontheweb.net/antiacidos_en_embarazo.pdfIn PDF document text
- http://rabemedexisubis.mygamesonline.org/biology_class_10_book.pdfIn PDF document text
- https://cdn.sqhk.co/zopizote/dAghXpk/guzegezevigelujazes.pdfIn PDF document text
- https://cdn.sqhk.co/merivexasug/3ggF9hb/46043888966.pdfIn PDF document text
- https://cdn.sqhk.co/lijipatalenu/hcyhjwg/nalufebomi.pdfIn PDF document text
- https://cdn.sqhk.co/votiwixuduzo/whdOljg/62508014872.pdfIn PDF document text
- http://dakisemakegag.sportsontheweb.net/6992464346.pdfIn PDF document text
- http://bulepozobagepud.mygamesonline.org/favapemufenokalokam.pdfIn PDF document text
- https://cdn.sqhk.co/woxemumi/hVzQY2D/wilobulepejofajitakirav.pdfIn PDF document text
- http://kumululurug.scienceontheweb.net/ashton_irwin_sister_age.pdfIn PDF document text
- http://likefetevu.getenjoyment.net/sanskrit_etymological_dictionary.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c9436730-ca39-4f49-ba72-832af3c0044b/planet_x_and_the_kolbrin_bible_connection.pdfIn PDF document text
- http://nakeviw.myartsonline.com/donedibatedamitezafapi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a618dec6-a737-407c-8f28-ba36dc81aa0e/how_to_get_ms_project_certification.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/11d0a61c-5a17-431a-a042-d86b7988551d/pandaria_flying_trainer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e6d8683f-839b-4d6b-99f1-19a1fd4cdcb7/azar_fundamentals_of_english_grammar-3rd-ed-workbook.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/35ea1884-ab3a-464c-9677-e7b27f4898a0/how_to_reset_galaxy_s7_active_to_factory_settings.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5972ddcb-322b-4409-835e-fa9b9424bc1c/tamil_novels_free_download_format.pdfIn PDF document text
- https://091a8774-b5bd-4fb7-8799-8d1ca0ca44ad.filesusr.com/ugd/8716ab_9dfe99c1974d4cba9f9f66348394809c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/00cf673a-c043-4ccb-9325-6b4d7b362aff/25558960262.pdfIn PDF document text
- https://393102e6-89af-4738-8cad-89662dba8dc5.filesusr.com/ugd/33a16d_2ff8b56c97d04e11ad2f6cdbfcd387c5.pdf?index=trueIn PDF document text
- https://911f1565-2faa-4874-b261-330d521e7362.filesusr.com/ugd/f46427_54e926aa494d4127ac38e1c2a7919669.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010ad4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10AD4 | 5524 bytes |
SHA-256: fb9bb49fa2a1dd781f6c65716059fa5bd2fdede727209e78be8f3da3a69e9688 |
|||
font_01_sfnt_off00011da3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11DA3 | 11288 bytes |
SHA-256: 518780b8dce3b516a17afb2391a28804959c4927e3c76e0eb27f313c627dc2a2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.