MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as Pdf.Phishing.Trojan. The file contains a large number of external links, indicating it functions as a link farm. These links likely lead to phishing sites or further malware downloads, consistent with a spearphishing attachment attack vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jacksth.ru/aws?utm_term=estructura+de+una+tesis+en+un+texto+argumentativo PDF link annotation
- https://xemegejimeje.weebly.com/uploads/1/3/1/6/131636808/1366896.pdfIn PDF document text
- https://jisixeda.weebly.com/uploads/1/3/1/4/131409884/surexateduku.pdfIn PDF document text
- https://cdn.sqhk.co/fugolamudara/GEjcgjb/city_car_driving_download_pc_demo.pdfIn PDF document text
- https://cdn.sqhk.co/nosimasiv/ifibhjx/visanex.pdfIn PDF document text
- https://novazoneb.weebly.com/uploads/1/3/0/8/130814043/143207.pdfIn PDF document text
- https://memezuwiz.weebly.com/uploads/1/3/4/7/134702577/jewimetisewo.pdfIn PDF document text
- https://cdn.sqhk.co/kokedipemi/ikjgiff/dwight_schrute_acting_manager.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/945975bb-c075-4320-8761-6534974762f7/93889144020.pdfIn PDF document text
- http://loxogosune.rf.gd/zuwamu.pdfIn PDF document text
- https://s3.amazonaws.com/ronenitevodo/bhagavad_gita_quotes_on_life_and_death.pdfIn PDF document text
- https://1482387f-61d8-47e1-b538-9b7f1e8b89fb.filesusr.com/ugd/538d67_b8ba34438ab346faba6d28d1b8faba55.pdf?index=trueIn PDF document text
- http://zezibinevuzeliw.epizy.com/apa_format_summary_example.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e395bdd8-5342-4bec-8475-9137cc530e8c/56464784523.pdfIn PDF document text
- https://s3.amazonaws.com/wufujudisu/viva_la_vida_sheet_music_easy.pdfIn PDF document text
- http://wekidezeze.epizy.com/videmudulop.pdfIn PDF document text
- https://0aed7b51-d02b-4864-a6bb-b478bb809667.filesusr.com/ugd/fbdaab_e66c728e3df941aa85e63c4d48229a70.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/cc4488ab-e3ea-4d56-9580-458ebd92e630/audio-technica_at-lp60-usb_review.pdfIn PDF document text
- http://rukilokurotog.rf.gd/niworofenekaf.pdfIn PDF document text
- https://6f12065f-c45d-410c-b048-6ec23fb2b810.filesusr.com/ugd/02ccf7_662e62e2012c46aeb98218a58e5711b1.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/fdecabc3-923d-44c1-a9aa-2f956657061b/gemolatazesegazozilebuneb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/630fa18f-a384-4279-a79d-c7d6eca74603/sunbeam_heated_blanket_blinking_f1.pdfIn PDF document text
- https://s3.amazonaws.com/minabiwa/70773738183.pdfIn PDF document text
- http://dunoziboxisi.epizy.com/austin_mahone_all_songs.pdfIn PDF document text
- https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_b45745be09af47a0b5dbbef87cc33f86.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/paxuvagal/vapikazujobufakanugavamir.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f030.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF030 | 5312 bytes |
SHA-256: aa6f67bc4239ce20ceac09b26a0ff02bd020284f5a26da172fcfcc03c0e635f7 |
|||
font_01_sfnt_off00010232.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10232 | 11560 bytes |
SHA-256: 1cd4ca802b954b5c8d3ec6c7c96f0f7bd45347bd878ce16231a849a390ad3db3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.