MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was flagged by multiple heuristics as a link farm and detected as malicious by ClamAV and an ML classifier. It contains numerous external links, many pointing to disposable domains, suggesting a malicious SEO or phishing campaign. The presence of embedded URLs and the overall structure indicate an attempt to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ponafet.ru/123?utm_term=ads+library+android PDF link annotation
- https://jabezenenadako.weebly.com/uploads/1/3/4/2/134234778/kuwixitat.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490515/normal_6051e8866e892.pdfIn PDF document text
- https://rewiwolidinagi.weebly.com/uploads/1/3/4/4/134481042/9aabebc.pdfIn PDF document text
- https://winomawapaba.weebly.com/uploads/1/3/5/3/135334931/sefikoluxik-kuzijevag-voripuselopoxon-rutaji.pdfIn PDF document text
- https://kigijizinelojuk.weebly.com/uploads/1/3/4/8/134848952/ladoluzujefo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454561/normal_6024f77d651f8.pdfIn PDF document text
- https://foxanebipukete.weebly.com/uploads/1/3/4/3/134309218/7824388.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4377100/normal_5fe257ddf2501.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/9354d45d-e717-4584-af97-98ba6e4bdc80/business_data_communications_and_networking_13th_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e626f6f1-0d2f-45d1-b5a0-a154855a3928/tavetagujef.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/99b3fbb9-0775-4d87-9709-c92146f1eb04/how_to_connect_universal_remote_to_toshiba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02b4bf79-5853-46de-a987-bd1839357e19/panasonic_42-inch_plasma_tv_2007_weight.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f71a9221-29ee-4fc1-a449-1bfc9e657dd5/new_navy_uniform_regulations.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8022fd84-6e07-459e-a57c-314de7e2a1db/conceptos_y_tcnicas_de_recoleccin_de_datos_en_la_investigacin_jurdico_social.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4bad4d34-48fe-4406-9a49-1e20055b1e1d/how_to_fix_my_irrigation_system.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/01495147-d64c-4c12-b159-7194abb89842/the_black_pullet_book_in_hindi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91d82947-c83d-4e92-a00c-180bd98c2f07/82964040732.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0de90129-ca04-4a0a-bb91-3da9f4bb6609/what_is_the_most_effective_topic_for_a_compare_and_contrast_essay.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7bfeca7d-ee23-4762-ad95-59eddefa64a8/vusixarumopo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/207cc086-d2c6-466e-863d-205fdfeedeb0/93434777597.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000102fe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102FE | 5048 bytes |
SHA-256: 7b8b070a57f3eb0bbeb31952179f10e6275c41466249993e45ad5e882e716184 |
|||
font_01_sfnt_off00011437.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11437 | 12348 bytes |
SHA-256: bfa8b8e51763d70c8f2f7657a34d0e1e5854ef11542796ebab2d50eb168afa37 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.