MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a password-protected-archive lure. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9959
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xajibur.ru/wix?keyword=ocean+state+job+lot+lafayette+road+seabrook+nh PDF link annotation
- http://tepugorotewole.medianewsonline.com/honda_bf90_service.pdfIn PDF document text
- http://sekegixederixit.iblogger.org/checklist_manifesto_book.pdfIn PDF document text
- http://xulazawelinuze.scienceontheweb.net/marantz_receiver_sr5008_manual.pdfIn PDF document text
- https://cdn.sqhk.co/rekutadis/c2ggjhh/cruise_from_galveston_to_mexico.pdfIn PDF document text
- https://cdn.sqhk.co/juvekuvop/jiMgehi/bomebitumuwixugumagetile.pdfIn PDF document text
- https://cdn.sqhk.co/dafisuwikib/fjijevt/coupons_for_family_dollar_smart_coupon.pdfIn PDF document text
- https://cdn.sqhk.co/midijanere/gjeJhdI/study_skills_definition_life_orientation_grade_10.pdfIn PDF document text
- http://jeratojovu.66ghz.com/88754009487.pdfIn PDF document text
- https://cdn.sqhk.co/bitowiso/iagdhg3/waniwotitip.pdfIn PDF document text
- http://jinevul.mygamesonline.org/royal_crest_definition.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/5a4f7cf5-0ccf-48ca-8a1d-be1212df11da/life_of_galileo_play.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9af5e63f-5512-4624-8f05-9913f3566bb9/61017529934.pdfIn PDF document text
- http://keregimuw.onlinewebshop.net/27695284374.pdfIn PDF document text
- https://s3.amazonaws.com/vovuzize/19293161582.pdfIn PDF document text
- http://zuxekesimulir.epizy.com/cambridge_university_press_catalogue_2018.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8de17892-f052-45dd-9e56-1d5031aa5d55/83870149066.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d54a52a9-4f19-4bcb-9fe8-f78e45805986/vampire_diaries_cast_season_7_lily.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fafa8f9a-ad77-4998-865e-ac78f68cb21f/the_lottery_analysis_questions.pdfIn PDF document text
- https://s3.amazonaws.com/jezobasit/beach_formal_wear_for_weddings.pdfIn PDF document text
- https://s3.amazonaws.com/varoximu/transformation_baignoire_douche_italienne.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01bf24e0-68ee-4548-83f2-2c646d1ff8a7/66666267014.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/629aa0f1-a847-4833-ac3f-f72c757a3de0/99429685581.pdfIn PDF document text
- https://s3.amazonaws.com/suxuzubojut/8198345691.pdfIn PDF document text
- https://s3.amazonaws.com/tesodagiwor/t-_shirt_layout_template_photoshop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7421e235-7e74-4c2b-95c2-aab2c91a02ac/how_long_does_an_ecg_report_take.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5756ed80-41f2-40b5-9c67-22da9bbb22be/nijiganitedufowixofiwejob.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d547.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD547 | 5520 bytes |
SHA-256: 73a843cbb9d6869b67f19e066ec7bbf406d8131723383e68fa9e2ebe597b54e8 |
|||
font_01_sfnt_off0000e80c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE80C | 10212 bytes |
SHA-256: cfe4ab0b7ec6b8724795a7712f3469f1c6c454c9fca193da7fc25148de9f72bc |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.