MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nomylo.ru/pbw?utm_term=we+need+to+talk+about+kevin+full+book+pdf PDF link annotation
- https://static.s123-cdn-static.com/uploads/4406775/normal_5ff08d0c64678.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423188/normal_600f090f3ef12.pdfIn PDF document text
- https://lovevupadu.weebly.com/uploads/1/3/5/3/135328586/pikev-pelaxus-kalevasuno.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4503214/normal_60698225e2d80.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408981/normal_604b7601702d9.pdfIn PDF document text
- https://rororejiwep.weebly.com/uploads/1/3/5/9/135966539/sikesoxisufaponib.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4387589/normal_5fd03cb40354f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4478667/normal_5fff7791cc694.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369905/normal_604e9ae0a8bf1.pdfIn PDF document text
- https://rulodewarozuw.weebly.com/uploads/1/3/4/6/134678260/7132076.pdfIn PDF document text
- https://zomubotedop.weebly.com/uploads/1/3/0/8/130873922/kurosupur_ruxifem_zamodinaxadap_vubonodu.pdfIn PDF document text
- https://luwegojozokozop.weebly.com/uploads/1/3/0/9/130969796/7383975.pdfIn PDF document text
- https://bazuditok.weebly.com/uploads/1/3/4/5/134590154/wedabokibokuw.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473384/normal_6013ba4ff2f26.pdfIn PDF document text
- https://kimidagox.weebly.com/uploads/1/3/4/4/134470984/tigipetu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/902ac219-45e0-4fbc-946d-3b5c8665afbb/tajanokefuwuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8c9fe363-404c-410f-b10e-3141ab6a5321/three_day_potty_training.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/117d371b-413e-447a-b9ca-c5b1291b05ba/is_sodastream_better_for_you_than_soda.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6142fb70-3e1d-462f-8ebf-9d847bb748fa/pathfinder_pawns_npc_codex_box.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/542005f1-0ffb-437e-a27e-39a0470b3808/how_to_measure_performance_of_a_project.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2f4d573-b9ea-480b-a9cd-71c72de1a537/how_to_reset_my_gas_hot_water_heater.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ddcf1284-7d40-42f8-a5ea-b09384303a88/74711185730.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e19e7ef4-c576-4466-91c5-65170d2172cf/fosirugixapused.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa68.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA68 | 5040 bytes |
SHA-256: 04e768e6fc52ee2062646ff5b13688876e48223ad0e27a5d407d260745c10ca8 |
|||
font_01_sfnt_off00010bba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BBA | 11040 bytes |
SHA-256: 6675f5ee88d364597af41fa2cdce64651b8d39dd495bd5d59dfb4a1969ef115b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.