MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file functions as a link farm, presenting itself as a search result for 'mental math worksheets grade 7 pdf' to entice users to click on numerous external links. The primary malicious URL identified is https://lozipotod.ru/award?keyword=mental+math+worksheets+grade+7+pdf. The file was flagged by ML classifiers and ClamAV as a phishing/malicious PDF, indicating a high likelihood of malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9954
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lozipotod.ru/award?keyword=mental+math+worksheets+grade+7+pdf PDF link annotation
- https://dagolitufewanat.weebly.com/uploads/1/3/5/3/135345669/mijepunur.pdfIn PDF document text
- http://quinzsy-studio.design/birthday_audio_songs_in_telugu_freejisso.pdfIn PDF document text
- http://becloud.website/basic_english_worksheets_ks3_for_freewsnw2.pdfIn PDF document text
- https://jurujixomegisi.weebly.com/uploads/1/3/4/7/134745805/zadolixegujofatu.pdfIn PDF document text
- http://bajesiradevo.getenjoyment.net/23157598107.pdfIn PDF document text
- http://wotedogupowu.sportsontheweb.net/oppo_bdp-105d_usb_dac.pdfIn PDF document text
- http://pakunobun.getenjoyment.net/76230784860.pdfIn PDF document text
- https://laziboxejebemu.weebly.com/uploads/1/3/0/7/130740401/1794773.pdfIn PDF document text
- http://lenugaguv.medianewsonline.com/center_parcs_sherwood_activities.pdfIn PDF document text
- http://mebotus.mypressonline.com/tebazubow.pdfIn PDF document text
- http://keluzizizeroki.getenjoyment.net/9104940682.pdfIn PDF document text
- http://betmoy56.com/34503292413e1nno.pdfIn PDF document text
- https://memibufosigi.weebly.com/uploads/1/3/1/3/131383384/7434294.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://e5447efa-8854-4d04-834e-f0bbd7438c8b.filesusr.com/ugd/ac612b_e542fa3c764d4af585f70a850bfc9532.pdf?index=trueIn PDF document text
- https://29159626-56e2-4eb2-a8c1-eb081f451e44.filesusr.com/ugd/a58502_3ab2a75508be4d7f989d9c6506f39794.pdf?index=trueIn PDF document text
- https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_938f446b2edd4244819d46456998e0b7.pdf?index=trueIn PDF document text
- http://nununad.myartsonline.com/82202931051.pdfIn PDF document text
- http://jimomurapujivo.onlinewebshop.net/kewuzuna.pdfIn PDF document text
- http://bavufupuvamopaf.atwebpages.com/ielts_speaking_topics_part_3_with_answers.pdfIn PDF document text
- https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_8597ce3650b54ada9d6de2fc78d3f54e.pdf?index=trueIn PDF document text
- https://87da31d5-d184-45e7-a456-0ad082c8bd65.filesusr.com/ugd/55e94a_cdeace79703140fdacaec764294f974c.pdf?index=trueIn PDF document text
- https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_e7ad41bf6421468aa3523ff30f2aa32a.pdf?index=trueIn PDF document text
- http://lojubefogugiku.onlinewebshop.net/3d_maker_for_nx.pdfIn PDF document text
- https://b0c090b1-cb02-46d8-8a69-3fb9d82636b6.filesusr.com/ugd/4dbf3f_c0beaebd8a1841c5ad5529adcdaa8d92.pdf?index=trueIn PDF document text
- https://f0198b83-f3fe-41b4-8315-bacd7eabb238.filesusr.com/ugd/2b3f46_21d2b60b3c964a9584f3492dac48fe9b.pdf?index=trueIn PDF document text
- https://ff4d9611-e7ea-45f2-85d3-f0b464ef817f.filesusr.com/ugd/48f461_8adbe0235ef247b09e3513a164241dc2.pdf?index=trueIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed2a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED2A | 5696 bytes |
SHA-256: 61bcbc32c7dc4abcbe2d19c95ae8add02f04a545415a86e8e730586a279f21de |
|||
font_01_sfnt_off00010091.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10091 | 10824 bytes |
SHA-256: 0974a92c5157da5103a6c2275d3bfa5cd949ecff00231fe73377f9f373f4b5af |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.