MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/strik?utm_term=what+is+the+best+power+pole+saw PDF link annotation
- https://cdn.sqhk.co/kamozipu/dvsgiid/69051801032.pdfIn PDF document text
- http://garantiya62.ru/likoxkj0aw.pdfIn PDF document text
- http://de-bewertung-889562.icu/2008_jeep_wrangler_engineu2hm4.pdfIn PDF document text
- https://cdn.sqhk.co/jozazixefuf/PPXgjs1/36334307605.pdfIn PDF document text
- https://cdn.sqhk.co/gebunemif/jd7Yjj8/wokavidanixol.pdfIn PDF document text
- http://montana-media.com/what_does_the_bible_says_about_peacex49h4.pdfIn PDF document text
- https://cdn.sqhk.co/fojevimexu/eNjamjh/mirejolupoxuzabomifevijon.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/69db92ae-3fc0-44e2-81f1-fe158a42c04f/bonubamavuf.pdfIn PDF document text
- https://s3.amazonaws.com/xixonu/88960372224.pdfIn PDF document text
- https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_1370ce32bb424814840e73b97c0a2e78.pdf?index=trueIn PDF document text
- https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_048003225fc145f6baac2bc7255f1299.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0aa07fc4-cbf0-4cca-a862-80626aac8899/tp_link_tl_wa850re_reset_password.pdfIn PDF document text
- https://s3.amazonaws.com/fisulefajow/accountant_client_termination_letter_template.pdfIn PDF document text
- https://56148a0a-83a3-4003-94ff-78d3044b7c00.filesusr.com/ugd/6f5f23_782ccf288d20429eba1cead8e8c065c6.pdf?index=trueIn PDF document text
- https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_98806719342c443da047e5bf97b69d0e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/wewiro/evenflo_chase_select_lx_reviews.pdfIn PDF document text
- https://7fca5364-97a1-4441-b76e-d2c429a59218.filesusr.com/ugd/735424_c9842ab2670d4bd89d1ed801ea867923.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dinigugaxej/self-_advocacy_information_definition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/62b02040-5b2e-48e6-ac35-61cd065cf846/calculus_definition_text_structure.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c66b4019-b396-4817-a5bd-9125f29ad0a2/doredokosagojerumijuxo.pdfIn PDF document text
- https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_bd7a698aaa394e14ad2f1a63dd42634a.pdf?index=trueIn PDF document text
- https://c18d9829-3add-4afa-bc87-35007fe3998a.filesusr.com/ugd/70c1ec_13bbc1eb35624840a1f5f90e9dcf7360.pdf?index=trueIn PDF document text
- https://60f6da8c-824c-4163-aae9-6195f2ac7ed4.filesusr.com/ugd/7f16bd_6308d00ed69b4a63bc523e7e6474df10.pdf?index=trueIn PDF document text
- https://011f98f8-b45f-4578-a2fd-466b530f7845.filesusr.com/ugd/74e905_46537641300a493caecf1785d12afac5.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001289f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1289F | 5152 bytes |
SHA-256: fd56cdd3cb051f78da58766938ac6ef1143e97a9963f122e0f0b818e9f413b29 |
|||
font_01_sfnt_off00013a33.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13A33 | 11372 bytes |
SHA-256: 02fe7cb07853ff0bde9a9ae32bf5881cb3fa6d50650cc9ffc1f66cf36d2e3a0a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.