MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file is identified as malicious by multiple heuristics and an ML classifier, specifically flagged as a phishing trojan. It functions as a link farm, directing users to various external PDF files hosted on disposable domains, likely as a method to distribute further malicious content or engage in phishing. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of numerous external links and the 'PDF_SEO_LINK_FARM' heuristic strongly suggest a deceptive purpose.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/award?keyword=acupressure+points+pdf+free+download PDF link annotation
- https://gupuvuzuguzi.weebly.com/uploads/1/3/1/3/131379578/3439694.pdfIn PDF document text
- http://dowotezovemalo.mygamesonline.org/bailable_and_non_bailable_offence_crpc.pdfIn PDF document text
- http://regudak.iblogger.org/7907491760.pdfIn PDF document text
- http://xanusojuruxu.sportsontheweb.net/bogoxufufejefufutexin.pdfIn PDF document text
- https://romuxejis.weebly.com/uploads/1/3/4/8/134887308/bonipufinud-gifebulolo-tidukudak.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://eac5c218-d238-408c-98a6-8ff0ecbb25fc.filesusr.com/ugd/b1277d_61ea60e53442401691d1bab5e5edbe37.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/708e5e3d-5d72-43fe-a500-e214140cd016/vowaxigifupukape.pdfIn PDF document text
- https://6c8ebe11-725c-420b-823a-68bc39d02ad2.filesusr.com/ugd/3e87bf_c79a0e7267c14eea99ebb7b4e1363d70.pdf?index=trueIn PDF document text
- http://jidafamibudajir.epizy.com/40892263869.pdfIn PDF document text
- https://f3dbd103-cf2f-44fc-b0ad-c9004dc38af2.filesusr.com/ugd/1f2646_afc135deea4346d89cd6aeb8ec453613.pdf?index=trueIn PDF document text
- https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_b1775fbe26df41a79a7120fda5da8885.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/accd2870-1b30-4c46-b8be-1f1e295a838e/what_fruits_are_good_for_gluten_free_pasta.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f0a6ad5-0d85-41a1-9996-f0d413f35e75/whirlpool_edr3rxd1_everydrop_refrigerator_water_filter_3_lowes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/352ccc26-a554-4b20-a8bc-cc13d36ede42/wedusodivakewipobojotewed.pdfIn PDF document text
- https://6843e3eb-5573-46e1-90a0-370cfc2b4a0d.filesusr.com/ugd/89b1bc_f2a9e68803344a3581d4e80da17c3dce.pdf?index=trueIn PDF document text
- http://xedawobu.atwebpages.com/84785541706.pdfIn PDF document text
- http://namakanexir.atwebpages.com/probabilidad_y_estadistica_para_ingenieria_hines.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b8432740-0de3-4491-9d5d-d9b68d92c780/93858624616.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6d32fb58-50e4-4418-9759-f5ebefa94b9e/doraemon_movie_stand_by_me_2_trailer_in_hindi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6704fd91-5ffb-4e51-9f1f-c465e53955c3/9159532229.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d528.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD528 | 5228 bytes |
SHA-256: 022411690d6a7052472dcedd17572bffb8cd20a197c4efffd34f1d7a0b5886f2 |
|||
font_01_sfnt_off0000e715.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE715 | 10692 bytes |
SHA-256: 66d49fd78c2f15256e669d60244b68ca54cc949b7142bfd5bfc6be72d97288b6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.