MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jottigo.ru/strik?utm_term=ejercicios+de+lengua+6+primaria+pdf PDF link annotation
- https://vosujesu.weebly.com/uploads/1/3/4/6/134646347/c19dc624f00.pdfIn PDF document text
- https://bamaxasujobuz.weebly.com/uploads/1/3/4/3/134315865/2b3843ea.pdfIn PDF document text
- https://muxiduxipa.weebly.com/uploads/1/3/5/3/135319221/piberiguzis_nikikekovat_revokepujuzipan.pdfIn PDF document text
- https://pumaxodevuk.weebly.com/uploads/1/3/1/8/131872084/bbf80e.pdfIn PDF document text
- https://xutobegepoxebax.weebly.com/uploads/1/3/5/3/135333125/9947017.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379221/normal_600be2ba69ad9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4382004/normal_5ff94051dd78a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502188/normal_6061bd2f811f9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416319/normal_60663301b975b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/e4b03f1f-c8c0-4fab-a647-253bc0f5056e/sanimugadajoxafixolekiwo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c7cbab83-aa0a-4db1-99be-de2d20de88e0/retos_que_enfrenta_la_educacin_tcnica_en_el_nivel_medio_superior_en_mxico.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9a1e66a-0ad1-4868-a241-d1130b3e5186/baby_girl_names_2020_unique_with_meaning.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/21ca454d-d75c-4ff8-a75c-7416e8719638/how_to_take_the_top_off_a_whirlpool_cabrio_platinum_dryer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1dbbd8ad-3759-4d22-b77c-73e1c1948276/mamugusesejezinunawob.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f78d927e-628c-4e22-aa0c-fbf5c2c37d3d/will_stephenie_meyer_write_more_twilight_books.pdfIn PDF document text
- https://s3.amazonaws.com/pojikovewijeja/extent_reports_selenium_python.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df474546-879a-4bca-9f1e-9cb4962907f7/pikuk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3552c0eb-1386-4512-ac27-2100416c79f2/craftsman_leaf_blower_gas.pdfIn PDF document text
- https://s3.amazonaws.com/jedobufudajewu/cisco_ccna_200-301_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000effa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFFA | 6440 bytes |
SHA-256: 2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb |
|||
font_01_sfnt_off0000ffef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFEF | 5664 bytes |
SHA-256: 87a522eaf900f32aee76807529e62a8f60f24c80ba7ae56b8a2bef648e60c773 |
|||
font_02_sfnt_off00011329.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11329 | 12120 bytes |
SHA-256: 2c07c97686e2068d0973a3ab838c85895da9a110f2fb1b3d3f78d2056c71392f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.