MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=how+to+get+ship+insurance+star+citizen PDF link annotation
- http://fukuzowi.sportsontheweb.net/cisco_sg200-50_console_port.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470400/normal_601d4f10e9d90.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380531/normal_601a7ea27546b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4452839/normal_60500d9c7f122.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421466/normal_6011c287c7816.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368487/normal_605daaf30fe4d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468296/normal_6042f7f89f8ed.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409000/normal_6024c20122385.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4392867/normal_5fecd1bfb852c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4493553/normal_5fc5a52e26dbf.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501364/normal_600ab028ac07c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444371/normal_6032a298bcc0a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/05cda4b9-edfd-4434-838f-71569a265910/bewasad.pdfIn PDF document text
- https://5efcf519-4c71-4be9-a00f-e1d47ba804c5.filesusr.com/ugd/ebcc4b_ec7501a63c0343a0bf79a68eee9c5722.pdf?index=trueIn PDF document text
- https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_c52bf7b8283a4e43af2da86bf70b378d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/98b46735-cff3-4daf-ad8b-6a09e3d31842/6003451575.pdfIn PDF document text
- http://lonesopuw.onlinewebshop.net/manomajale.pdfIn PDF document text
- https://7e005a1c-fb68-43c1-af83-b854b6a2d282.filesusr.com/ugd/dcfb95_d15d30187b5143eb9cc5435887184c0c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/39a9448b-ceb6-4a4d-8770-2cd552d2ce21/44072851633.pdfIn PDF document text
- https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_8ecc344a5f584dbca1c9cd5bcbd48d1b.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bdf26aea-8818-4592-af42-6c06210960f7/download_primal_carnage_extinction_pc_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/85a49bc6-024f-4486-b3fa-84765608fa34/8273169765.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001aa2a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1AA2A | 5264 bytes |
SHA-256: 8375576e2988b440ec90472388b11c3ca233bc40dd137cabc6b46aa6bab187f7 |
|||
font_01_sfnt_off0001bc2e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BC2E | 12328 bytes |
SHA-256: 82860e67cdff5d93ec1eead7a97d3c4e70f3b2dfc406cc80e39d980f8b557340 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.