MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/wix?keyword=asi+se+dice+level+2+workbook+answers+6.4 PDF link annotation
- https://gijowazav.weebly.com/uploads/1/3/4/0/134097260/zopewuzakuxa.pdfIn PDF document text
- https://cdn.sqhk.co/rizijuwet/ia8tjvV/95346507905.pdfIn PDF document text
- http://persequenteamsohbet.com/dell_optiplex_gx620_sound_driver_download_windows_7klixv.pdfIn PDF document text
- https://cdn.sqhk.co/noligigibar/e9gfujg/nazaginuluweleninewevo.pdfIn PDF document text
- https://kanumipiga.weebly.com/uploads/1/3/5/3/135346224/621030fd2998.pdfIn PDF document text
- https://cdn.sqhk.co/rukugewul/djaNqtw/xamokusuvuxasafivuwesajiz.pdfIn PDF document text
- http://afracheat1.xyz/what_is_the_main_idea_of_sojourner_truths_speech5ez4f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://73b3f487-90f5-41a6-bf44-750372f72efd.filesusr.com/ugd/39e8d0_bb1b04fcf1f04ea692c9d82d2b02a49c.pdf?index=trueIn PDF document text
- https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_e14cc0243b844f84a6b3023f4de92405.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/a56cdbc3-0697-4c81-bd94-edf7b03287df/66986735189.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3342188f-1c4d-4268-8e8c-5f2ebaf0db87/buperuxoderirozo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d6e74622-8317-44aa-a2e2-eea17bbb2ea6/718247601.pdfIn PDF document text
- https://27a83426-c768-4525-a63d-b5b732cca755.filesusr.com/ugd/28b3f7_539b7218cd874bd1ab0762fedfdf5c39.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b35cf31a-e99b-420b-be94-73722d4c0248/phet_interactive_simulations_balancing_chemical_equations_worksheet_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ddfb721c-4b8d-43f0-b39f-7cbbf26cbfbc/25402992003.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b9663d4c-703a-4c05-b861-483eb6006fe2/the_ultimate_measure_of_a_man_mlk_quote.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8dbfdee3-277c-4a6f-861a-c7f251e9837b/warhammer_40k_book_mega.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da32f701-e606-4c15-b44b-faeb19ff2b77/how_to_change_oil_in_ez_go_gas_golf_cart.pdfIn PDF document text
- https://9e1e9198-0fe7-4103-8084-fdcc6befb8d5.filesusr.com/ugd/2f7815_40513df7fbac42449796843c58b87794.pdf?index=trueIn PDF document text
- https://9e705916-5bde-4eb8-be9b-8b3e910fbaf8.filesusr.com/ugd/c7a620_977f04b98b784223bf58cfd23be57e09.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e3aa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE3AA | 5684 bytes |
SHA-256: db7fe3cd5ed163bc45fa6f1d0c7b866b33587b0e2b4364d576ac33661c04905b |
|||
font_01_sfnt_off0000f734.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF734 | 10512 bytes |
SHA-256: 186429462c3db2f31970be9b469233d50b5ce1387a9583f51e04f9328382aed8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.