MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://golowaki.ru/wix?keyword=lord+of+the+flies+conflicts+person+vs+person PDF link annotation
- http://kosamaritaj.getenjoyment.net/59103002918.pdfIn PDF document text
- http://biolinkus.me/can_i_check_a_lottery_scratch_tickets_online0xy8h.pdfIn PDF document text
- http://dufifudusimube.mygamesonline.org/white_tiger_movie_1996_cast.pdfIn PDF document text
- https://cdn.sqhk.co/mukibusu/igeheic/97167675092.pdfIn PDF document text
- http://paxosij.mygamesonline.org/noxiva.pdfIn PDF document text
- http://phillipen.online/72058689056lu5oi.pdfIn PDF document text
- http://veviwumifuvemuz.mypressonline.com/43541685077.pdfIn PDF document text
- http://resimpub.com/697220346309qhz6.pdfIn PDF document text
- https://cdn.sqhk.co/sesakiwewe/Qig5MZZ/58054490242.pdfIn PDF document text
- http://g2am2e.xyz/the_future_of_humanity_michio_kakuvv81p.pdfIn PDF document text
- http://giwosoto.sportsontheweb.net/16677311854.pdfIn PDF document text
- http://xasumemazekejo.scienceontheweb.net/pearson_sociology_textbook.pdfIn PDF document text
- http://reduslim-buy.site/duzadigik0u9gk.pdfIn PDF document text
- https://cdn.sqhk.co/mikevoponage/hhih2ja/tefatodenazipo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://xenezipulugiji.atwebpages.com/jfe_waste_to_energy.pdfIn PDF document text
- https://a43ab9c2-5efb-4cee-ac06-b782a0f5e207.filesusr.com/ugd/4826f5_a188a9497fb242f0a5b18d24f4025755.pdf?index=trueIn PDF document text
- https://f84ffea9-2755-49c2-9cb5-47ca8b55fe65.filesusr.com/ugd/0adedf_276dbe275df14e2da91be05bcb38bd44.pdf?index=trueIn PDF document text
- https://4f65501f-cdae-4966-b9db-49b15ad9d196.filesusr.com/ugd/52b593_e4e7ea1fe3774ced9a4b3bd67cfd859d.pdf?index=trueIn PDF document text
- https://5a995288-ce6f-4ae3-a3e6-14272d8003db.filesusr.com/ugd/7be1cd_c817d0dcc81f4e9e8eea1f68aedfa733.pdf?index=trueIn PDF document text
- https://6196a4e6-b3b5-4a85-a139-4ec84e0a53d9.filesusr.com/ugd/d01287_86a26020150a49398d412a885cacc7e4.pdf?index=trueIn PDF document text
- https://ca7c05ed-d233-4774-9cf9-08ff86aa6c73.filesusr.com/ugd/b42fd6_9b2c265428304936968995e1730e9662.pdf?index=trueIn PDF document text
- http://todifisafi.atwebpages.com/fapebejalogopozut.pdfIn PDF document text
- https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_08c996a1cbb844d39c77427e7280a118.pdf?index=trueIn PDF document text
- https://b5c90759-dbf8-4ccd-b12d-e23c958527f9.filesusr.com/ugd/915a55_6f3458a99ace4df79f2ecb01f9feaed2.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f919.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF919 | 5032 bytes |
SHA-256: f6396585e34d0403cf2fcc2c012574d90188f53c1fd270c1e341e534c3b505a6 |
|||
font_01_sfnt_off00010a46.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A46 | 11300 bytes |
SHA-256: 6e33118a777d168602638188490f9ddf60065e6f9f42c595bb360b2c7d0c1f72 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.