MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9987
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/award?keyword=california+fire+code+2020+pdf PDF link annotation
- http://drive4mclaneeffingham.com/salems_lot_vampire_images811h6.pdfIn PDF document text
- http://kellys.space/what_teams_have_cap_spaceprk4g.pdfIn PDF document text
- http://baugroup.info/daily_full_body_stretch_routineoho52.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4376105/normal_5fceffca00093.pdfIn PDF document text
- http://123dutch.com/537596148959hrz0.pdfIn PDF document text
- http://aromaita.space/aila_re_aila_dj_song_freedqn9m.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366961/normal_5fd289640e072.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/41c99344-7d23-4d72-97cd-e79297864c10/best_stihl_petrol_long_reach_hedge_trimmer.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9c98060-37bb-4eaf-b7f2-71a359ced348/what_is_the_main_idea_of_the_pilgrims_progress.pdfIn PDF document text
- https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_0be0ac5a015741fea51f91404454eafe.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/5c1cb553-aba5-4679-b9c9-4443c4a824d9/signals_and_systems_a_primer_with_matlab_solution_manual.pdfIn PDF document text
- https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_d3ab7b5057d64b20a2077ff1c31c0d97.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/mefadedosuw/english_dictionary_app_free_for_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3e76b44-07f2-4024-944f-4b31abf93d02/idiots_guide_to_climate_change.pdfIn PDF document text
- https://391e4f24-9fc9-4707-ac06-338edcd9f959.filesusr.com/ugd/110ef3_0a5fb2f6302949fdb1b0043e725e1f91.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nojemi/cylinder_gas_audit_form.pdfIn PDF document text
- https://b5c4f4dd-ae1f-4f6a-908c-f463551224e4.filesusr.com/ugd/dafd60_35802978f339452eab8e3d1985bf31dd.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1bbd6304-4402-471f-ab9e-07064f18bf6f/lodekaso.pdfIn PDF document text
- https://dca540c6-954d-4243-9f09-0921753db957.filesusr.com/ugd/974a4e_52947d82881042819a055837441a3dbe.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/paropabaru/romegex.pdfIn PDF document text
- https://s3.amazonaws.com/goneduzum/39759380321.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f154.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF154 | 5152 bytes |
SHA-256: 0c79dc1de99cee8dc1371ff50634c2e6a52d5d1d94037b248209e5791f10787d |
|||
font_01_sfnt_off000102e5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102E5 | 11664 bytes |
SHA-256: 65c6bc0736eb6845b8c1635e0029efa27a5d61eae28b88e4709c76a2188cda8d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.