MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are SEO-optimized and lead to redirectors, a common tactic for phishing or malware distribution. The heuristic PDF_SEO_LINK_FARM and PDF_SEO_UTM_REDIRECTOR_LINK indicate a deliberate attempt to create a link farm for SEO purposes, likely to obscure the final malicious destination. The ClamAV detection and ML classifier further support the malicious nature of this document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/award?keyword=b%25C3%25A0i+h%25C3%25A1t+m%25E1%25BA%25B9+ngu%25E1%25BB%2593n+c%25E1%25BA%25ADy+tr%25C3%25B4ng+pdf PDF link annotation
- https://losezereveki.weebly.com/uploads/1/3/5/2/135296388/dibodigidaru.pdfIn PDF document text
- https://mikugixu.weebly.com/uploads/1/3/1/4/131438693/2983464.pdfIn PDF document text
- http://kitadopitunija.iblogger.org/sociology_of_health_healing_and_illness.pdfIn PDF document text
- https://cdn.sqhk.co/jilebodetifa/igAhigC/motaratosenamubebuxopi.pdfIn PDF document text
- https://nijomusuvul.weebly.com/uploads/1/3/4/6/134671469/zivufelafekonu-pisenirozokifuz-setakamaze.pdfIn PDF document text
- https://welajewovire.weebly.com/uploads/1/3/3/9/133999455/c4b7fb7f.pdfIn PDF document text
- https://ronewomiz.weebly.com/uploads/1/3/0/8/130874064/kinowumutudegof_runirunobu.pdfIn PDF document text
- https://cdn.sqhk.co/konosoka/gjjJ1gc/tanglewood_apartments_southern_pines_nc_28387.pdfIn PDF document text
- https://cdn.sqhk.co/jutafegobexe/ifnUibr/spirit_halloween_animatronics_2019.pdfIn PDF document text
- https://cdn.sqhk.co/dodamewope/hijbke4/74873684322.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_f9bd2d0f453048feb988458a4c3b3629.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/filidabut/how_to_use_a_minolta_camera.pdfIn PDF document text
- https://s3.amazonaws.com/sizabo/robinair_34788ni-h_parts.pdfIn PDF document text
- https://e0eedba4-cf99-4c42-97f5-d3f9ae5832dd.filesusr.com/ugd/e36ea7_1443108a2e60418cbb1d4b767eddf599.pdf?index=trueIn PDF document text
- http://xufenazaliwe.epizy.com/bakemesurawutogilolurevo.pdfIn PDF document text
- https://s3.amazonaws.com/bejikefowu/petty_cash_template_south_africa.pdfIn PDF document text
- https://s3.amazonaws.com/jewizopukuni/bms_smart_app.pdfIn PDF document text
- https://s3.amazonaws.com/zasepo/how_stock_market_works.pdfIn PDF document text
- https://29c5b005-6627-40e3-9da1-9f9d3dbc34dc.filesusr.com/ugd/7ad284_c6b2df13322d46b598d65ad76a19f98f.pdf?index=trueIn PDF document text
- https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_e4a0594f59d941fa8138842cd2a827ae.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/gezetega/aixam_crossline_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d1a1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD1A1 | 6464 bytes |
SHA-256: a8eb9a5e425f9a2e3cc0044294230b0093c825d21718ce7dc47b8b53cc505834 |
|||
font_01_sfnt_off0000e58e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE58E | 18176 bytes |
SHA-256: 3e30f75b7b9818a74df4a62f9157d88f692272abb72a3f735c9780bacc38c6cd |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.