MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, many of which are generated and appear to be part of a link farm designed to manipulate search engine results. One prominent link, 'https://crophysi.ru/aws?utm_term=1000+point+nurgle+army+age+of+sigmar', is disguised as a search result for a popular game, suggesting a phishing or malware distribution attempt. The ClamAV detection and ML classifier further support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.9405
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/aws?utm_term=1000+point+nurgle+army+age+of+sigmar
- https://cdn.sqhk.co/xenudipu/iS1cXYl/sirotutuzekigak.pdf
- https://cdn.sqhk.co/wesuwajil/fje3Fam/kiduwemoveraxisivifona.pdf
- https://cdn-cms.f-static.net/uploads/4369901/normal_600d97e49f565.pdf
- https://cdn.sqhk.co/xevowuto/eqhccbE/10722522005.pdf
- https://cdn.sqhk.co/wabitakenina/gg5ifig/aca_neogeo_metal_slug_3_switch.pdf
- https://cdn.sqhk.co/sixitigoxeto/jjU8rhd/penalty_kicks_game_online.pdf
- https://static.s123-cdn-static.com/uploads/4415331/normal_5fc9cbfc0d760.pdf
- https://cdn.sqhk.co/mobubivifa/djcbji1/ghg_clockwise_login.pdf
- https://cdn.sqhk.co/biloriput/ve0jiJ4/wezebajepedim.pdf
- https://cdn.sqhk.co/dibitarebizu/xf5jhU5/89373701657.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://df256b98-640c-444d-885a-8195c7360722.filesusr.com/ugd/40b9e6_4a156f36209b498c9d29fe8e7e4bc94e.pdf?index=true
- https://uploads.strikinglycdn.com/files/12c9323f-7e8f-44ef-b26f-edaa202ac168/92535056300.pdf
- https://uploads.strikinglycdn.com/files/2bca5412-e651-4217-b9d0-4de2ecc65bf3/roxexuwetorubatesuguzen.pdf
- https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_83793c09ebb940549922dbabbfbced1d.pdf?index=true
- https://528a8416-53f4-4693-bcf0-540471887af1.filesusr.com/ugd/c3aa89_d9d9f4cb715c4eaabbb96b4b5dba6699.pdf?index=true
- https://uploads.strikinglycdn.com/files/05334d8c-31f0-418b-ad5d-705807cf836a/english_lesson_speaking_activities.pdf
- https://s3.amazonaws.com/lumixi/tutabezaduvazajiwedop.pdf
- https://s3.amazonaws.com/sajatofubote/international_business_the_challenges_of_globalization_global_edition.pdf
- https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_22cc2c679e62448caa13d115ea949b6f.pdf?index=true
- https://uploads.strikinglycdn.com/files/850653de-1de7-4bf5-87f7-7e81ca57ab3d/can_am_outlander_500_maintenance_reset.pdf
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002181d.bin21768dcf9ab1c67d8069fc5c5e1d8fa60a1b106ee3567bcd14fa4c0cb36844cc |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2181D | 3664 bytes |
font_01_sfnt_off00022559.bine72bd181079ec05b8fe797b4c707f84a0e440e9251cc36546be7bdbfdff586a9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x22559 | 5304 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.