MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm and contains embedded JavaScript. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kuzutuzo.ru/wix?keyword=solving+two+step+equations+maze+worksheet PDF link annotation
- https://bosaralox.weebly.com/uploads/1/3/4/6/134608385/xuxuvodoko.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4366381/normal_5ff9fe26f0cd0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414331/normal_601fb646b91f4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4494147/normal_5ff5562ab42a9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4467273/normal_5ffc767dabacb.pdfIn PDF document text
- https://ledijonag.weebly.com/uploads/1/3/4/6/134689342/b782db.pdfIn PDF document text
- https://tuwagufo.weebly.com/uploads/1/3/3/9/133999840/sasakujuk.pdfIn PDF document text
- https://nujazovarurep.weebly.com/uploads/1/3/1/8/131856890/doxusuruz_vurizorelijizi_fekakafunojos_duwumu.pdfIn PDF document text
- https://kaperimivegorew.weebly.com/uploads/1/3/4/3/134371305/891142e848d.pdfIn PDF document text
- https://tezijiso.weebly.com/uploads/1/3/4/6/134690371/6e012ba84d25.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450890/normal_60125284398b4.pdfIn PDF document text
- https://xopomosafeg.weebly.com/uploads/1/3/4/7/134732974/6129ab.pdfIn PDF document text
- https://robesiso.weebly.com/uploads/1/3/4/5/134501854/89f3e2154.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sizadagazagaj/ejercicios_de_gramatica_en_ingles_nivel_basico.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b55806c6-d2c4-404c-b1f0-da55baea79dd/how_to_adjust_a_carburetor_on_a_briggs__stratton_lawn_mower.pdfIn PDF document text
- https://s3.amazonaws.com/vavejijitatofu/hillshire_farm_honey_ham_cooking_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/543be796-d92f-41d6-adbb-82c4f78d818e/notufuzanabofi.pdfIn PDF document text
- https://s3.amazonaws.com/jevopemosod/vafevex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6b82961-3757-44e9-8613-0599dea65460/what_is_the_symbolic_meaning_of_a_tiger.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee69cda5-104d-465e-9d0c-9fd4290b044e/joneniwogutokelejepofuru.pdfIn PDF document text
- https://s3.amazonaws.com/fizaxo/vupogixufotowimuxokiled.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4546599d-6fd8-4516-b38f-ed66bd38b736/line_6_pocket_pod.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c84e05c9-0c6e-44df-8b92-b80434c0adf3/vidowewabomuruwigugid.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000cc59.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCC59 | 5728 bytes |
SHA-256: 345f35a5004698b17c52dd908055621fdc5d279d35661acaeac34debddb8a8df |
|||
font_01_sfnt_off0000dfc7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFC7 | 10376 bytes |
SHA-256: 830f50ac27d1018c72ec09ceb8e814c8873bdf482ebd79a9b9e0a726804f21c4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.