MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a large number of external links, with a critical heuristic firing for a 'PDF_SEO_LINK_FARM'. One of the primary external links points to a URL that appears to be part of a link farm. The ClamAV detection and ML classifier also indicate maliciousness, with the ClamAV signature suggesting a phishing or trojan component. While no scripts were directly extracted, the PDF structure and link farm suggest an attempt to redirect users to malicious content or phishing sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=l+or+de+blaise+cendrars+pdf PDF link annotation
- https://pufotesur.weebly.com/uploads/1/3/1/3/131378771/fogezale.pdfIn PDF document text
- http://ludirobus.getenjoyment.net/how_to_reset_a_viper_car_alarm.pdfIn PDF document text
- https://rudumareta.weebly.com/uploads/1/3/1/8/131871695/bereriger_gavasikowepez.pdfIn PDF document text
- https://sogatetemurus.weebly.com/uploads/1/3/4/3/134379625/zasurolikul_xiridim.pdfIn PDF document text
- http://ravasixojodari.mygamesonline.org/13702681318.pdfIn PDF document text
- http://nibewubixela.getenjoyment.net/nuwezabawetejisesoni.pdfIn PDF document text
- http://fodefon.getenjoyment.net/lalumogamovibikel.pdfIn PDF document text
- http://rexonina.medianewsonline.com/formas_de_comunicacin_oral_de_los_pueblos_guatemaltecos.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/baxegezivumi/boston_market_chicken_pot_pie_price.pdfIn PDF document text
- https://s3.amazonaws.com/tosego/74458998709.pdfIn PDF document text
- https://s3.amazonaws.com/vetamedisoz/fafifob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/14012e32-e31c-4250-bdbd-289c7618508f/57307828394.pdfIn PDF document text
- http://kuwitabetegipo.myartsonline.com/define_instructional_leadership.pdfIn PDF document text
- https://s3.amazonaws.com/rogugagatuf/casio_gw_9400_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d771d37-5790-4b29-87aa-244d2749045b/how_do_you_know_how_many_elements_are_in_a_compound.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8a7ef74d-b6c8-434e-8c3e-c52dce92af36/the_ending_of_the_mist_finally_gets_explained.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f517bff2-99c5-4de5-afdd-237bbe7988e8/14712696434.pdfIn PDF document text
- https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_eb3b2696583e4ee19da235113807a236.pdf?index=trueIn PDF document text
- http://makakanow.onlinewebshop.net/how_to_become_successful_in_network_marketing_business.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3d7812d3-eee3-479a-9dc7-46f2bed8f6f9/doro_cell_phone_voicemail_instructions.pdfIn PDF document text
- https://54a0e2cb-796f-4f80-9aaf-d11633176b06.filesusr.com/ugd/b0c554_b009b5dd19cb4dc8b4f5a4045aaa7156.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/vonutavekip/edital_prf_administrativo_2014.pdfIn PDF document text
- https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_8bcd7e056f6146ea8ac05054a0e1cef6.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010f5c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F5C | 4940 bytes |
SHA-256: 9c7aa3ccc0f90d4f64347cf1bdf2104887576abf1636f0937aba989667a13252 |
|||
font_01_sfnt_off0001201e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1201E | 10380 bytes |
SHA-256: 967aa5682878de910036005f35627a8915f7b31c8ea9402044bcc056d2c82bfd |
|||
font_02_sfnt_off000143b9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x143B9 | 4324 bytes |
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.