MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many hosted on disposable domains, suggesting a link farm designed to redirect users to potentially harmful websites. The primary malicious URL identified is https://maypoin.ru/wix?keyword=mahar+private+high+school.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=mahar+private+high+school
- http://pozijuza.scienceontheweb.net/9923994159.pdf
- https://static.s123-cdn-static.com/uploads/4476751/normal_5ffd442ec4f58.pdf
- http://lajafago.medianewsonline.com/rikow.pdf
- https://cdn-cms.f-static.net/uploads/4388183/normal_5fd6f28114239.pdf
- https://cdn-cms.f-static.net/uploads/4447097/normal_602436c64f6ae.pdf
- http://wewogokuwidu.mywebcommunity.org/pezufom.pdf
- http://gexopidikimo.mygamesonline.org/69770201563.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://599b09cd-7b6a-4758-94a3-08a08d316165.filesusr.com/ugd/628a76_673dcbf0bfd64b2b8580e9261f2ec56b.pdf?index=true
- https://s3.amazonaws.com/negonanopix/canada_citizenship_guide_2018.pdf
- https://850a36a1-966c-46c3-86ed-e15bcb5778a7.filesusr.com/ugd/ede58b_92ee9d1a7bba430a88b67ac3aa166aca.pdf?index=true
- https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_38e452dd54d74a8085dc4ac720ac6a18.pdf?index=true
- https://uploads.strikinglycdn.com/files/fc58696d-5825-45d6-a8cf-b4de88556312/9754903065.pdf
- https://30383b9b-b26a-44f4-9a26-03873af8f03c.filesusr.com/ugd/fdee49_da79b11e27524569aa601f849584d85d.pdf?index=true
- https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_299ae7a86ab34405bc78bc415048747e.pdf?index=true
- http://kilarosine.atwebpages.com/86169797200.pdf
- https://1482387f-61d8-47e1-b538-9b7f1e8b89fb.filesusr.com/ugd/538d67_c414c5f17c8b4bf8a483c9fa736b454a.pdf?index=true
- https://9a86171b-24d8-4f43-8717-687e75280c8f.filesusr.com/ugd/6234e8_6a262f2ee23f4f02865780764deb78b4.pdf?index=true
- https://fc06435f-e709-4c80-b59d-96fa470c1a13.filesusr.com/ugd/bdc04d_b69e2d11485d4bd4ab2316d3a9bc5fba.pdf?index=true
- https://uploads.strikinglycdn.com/files/e6291a07-7908-4302-b858-26d90b3670bd/chicco_buggy_liteway_3_jet_black_review.pdf
- https://s3.amazonaws.com/juzinaramip/how_to_get_radius_of_cylinder_from_volume.pdf
- https://s3.amazonaws.com/wifiduxezo/functional_skills_english_entry_3_worksheets.pdf
- https://uploads.strikinglycdn.com/files/9f81837d-e4e7-45f9-8272-6ee5f592ea8f/what_happens_if_you_marry_your_2nd_cousin.pdf
- https://486bfeb6-87d8-40a3-812f-3449909c9139.filesusr.com/ugd/81b904_0dd0a7af315645f382e9a6be4cb796a0.pdf?index=true
- https://s3.amazonaws.com/bidemewufa/belzebubs_blackened_call.pdf
- https://0524119b-9543-44d4-a9c1-6a2a85ae2681.filesusr.com/ugd/b12506_75a5d55e5ec6418c9764f1ebb51c47eb.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000113da.binc640e9555a75c8cc483aa8a5e778aa45fcde8f08f8c562b171aa8799d24850ea |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x113DA | 5260 bytes |
font_01_sfnt_off000125d1.bin46893e0e1c6b8dbd87e1ee6211850afaa028d5bb78469a985895a7c35c1bbed2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125D1 | 11388 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.