MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a large number of external links, many pointing to disposable hosting, suggesting it is part of a link farm designed to redirect users to malicious sites. The primary malicious URL identified is 'https://inwebjor.ru/pbw?utm_term=au+size+10+measurements', which is likely used for phishing or scamming purposes. The ML classifier and ClamAV detection strongly indicate malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/pbw?utm_term=au+size+10+measurements PDF link annotation
- https://cdn-cms.f-static.net/uploads/4471996/normal_602c3045b05b7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4378621/normal_5feb4d0ef23d3.pdfIn PDF document text
- https://jesemokomu.weebly.com/uploads/1/3/4/6/134687046/zimem_gefogiki_pitij.pdfIn PDF document text
- https://lidajegufevu.weebly.com/uploads/1/3/5/2/135299661/kotijudimuzifed_kisavapugipego_rapopikubu_pubumamipibe.pdfIn PDF document text
- https://rajopolaxobi.weebly.com/uploads/1/3/1/4/131406270/5cda76ad42.pdfIn PDF document text
- https://wigadanoj.weebly.com/uploads/1/3/4/4/134404864/sagemadivep.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502464/normal_6041b1d78475c.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/be43c982-c32d-4902-bcd8-88cb5746e097/megutitox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4c632c86-2da2-4a7c-bf09-439682ddd23c/xojasox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e605ef4b-a649-40bc-9c0c-40fa0be95bfb/saxon_math_course_3_book.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/895b9f3c-a25b-4854-8401-ab6789c8acfa/sandisk_mp3_clip_sport_go_32_gb.pdfIn PDF document text
- http://fuxedemama.pbworks.com/f/disney_plus_begin_enter_code.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c3a8ccd0-d693-4dd0-b932-15163fb37191/do_percy_and_annabeth_break_up_in_tower_of_nero.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7619a958-6312-4f5d-a313-17350a94db9a/dna_structure_worksheet_answers_section_10-2_review.pdfIn PDF document text
- http://lijunew.pbworks.com/w/file/fetch/144787008/95032208169.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7a9c97d4-e9fa-4eb5-9faf-0b0bbf19ff7d/how_to_find_4_digit_code_for_sharp_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73a56bd1-be7d-4f2b-9c94-9102c364c0e1/how_to_download_android_auto_in_malaysia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7556c69-da00-4346-8879-ee3039a69f11/46130675494.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/00e23745-e172-44b0-bd30-2ef811ee40cb/fumuduwapumidekebisedoxat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a30197ea-1af1-421b-bb52-b09be03e848b/software_development_manager_cv_example.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ff12.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF12 | 5032 bytes |
SHA-256: 078a5342b51969bec649b8f567de0da3126039a4e974c84581b7ec0f44a8e209 |
|||
font_01_sfnt_off0001101e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1101E | 10620 bytes |
SHA-256: 2c6de54d79fb9b492a8157924bf977ccd0a9d8a977eb9591a0a24e80d7a31629 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.