MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics as a link farm designed to host numerous external links, many of which are SEO-optimized. The ClamAV detection and ML classifier strongly indicate malicious intent, likely phishing or malware distribution. The embedded URLs and the PDF's structure suggest it's part of a campaign to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cructi.ru/pbw?utm_term=essential+agricultural+science+textbook+pdf PDF link annotation
- https://gevupowola.weebly.com/uploads/1/3/1/4/131483584/a988a1c6d2.pdfIn PDF document text
- https://vomogavuxif.weebly.com/uploads/1/3/4/7/134762738/9e9e20.pdfIn PDF document text
- https://nofemifi.weebly.com/uploads/1/3/2/7/132710694/pedudegiwu.pdfIn PDF document text
- https://zapunetiregete.weebly.com/uploads/1/3/5/9/135956705/nilagus.pdfIn PDF document text
- https://xowozasa.weebly.com/uploads/1/3/3/9/133999953/a4fc5.pdfIn PDF document text
- https://palotuzumi.weebly.com/uploads/1/3/5/9/135991270/zuxubapatibas-segipes-tobilekagite-zizodigekibas.pdfIn PDF document text
- https://vegipojefatelon.weebly.com/uploads/1/3/4/8/134876486/9372501.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8132b741-3911-4240-aa92-1ff89a9ebc0f/motazegapav.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5717215a-2f0e-47fb-889f-24bd2a505261/childrens_stories_about_listening.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9b2920e6-8b27-4e3b-8953-431d32ca5a92/dm_screen_5e_reddit.pdfIn PDF document text
- http://jutifakukap.pbworks.com/w/file/fetch/144483915/961923197.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c04c9fce-9a59-45da-8814-5ee5f15b6943/1st_grade_math_questions_and_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/56bbaf71-bdc4-4d2c-88a3-a73b799a244b/54522731214.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1a0f0f67-c2b7-45dd-95eb-e16f9a75d4fd/wifibudebamajasipawoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/015d5f99-01fa-462f-9f68-9f54e2e9c707/down_to_the_river_caplan_chords.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f51ff54-62f9-448e-b5fd-6dce94dd4679/78928655864.pdfIn PDF document text
- http://tukufidanega.pbworks.com/f/supplier_satisfaction_survey_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ecbdd1a8-975a-47d0-8f31-2aff5e9d7ea0/king_kong_usa_massage_chair_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c10e3bd1-e843-47f6-a8d3-ff024aa14cb5/agatha_christie_books_sale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/243cffee-1cef-4e44-aeb6-c77da4f12ca8/data_communications_and_networking_forouzan_solution_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e479fce-9327-47d9-8528-7874a1119432/povijedifenuxoxujevana.pdfIn PDF document text
- http://ravowibosu.pbworks.com/w/file/fetch/144443733/22304353879.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000da77.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDA77 | 5552 bytes |
SHA-256: 599511d574958f760d0f4d31ba21669be2e712070dc7f743476a576c20c9a3a5 |
|||
font_01_sfnt_off0000ed70.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED70 | 10760 bytes |
SHA-256: feb598ce56da005ab0765d05b8979ae2aed82e39c099d052e2a05e8f9b9bd254 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.