MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm designed to redirect users. Heuristics like PDF_SEO_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM strongly suggest this malicious intent. ClamAV detection and ML classification further confirm its malicious nature, likely serving as a lure for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=maven+java+eclipse+project
- https://zifokodogip.weebly.com/uploads/1/3/1/3/131398222/tituji.pdf
- http://hookup754.fun/keeping_the_republic_6th_brief_editionfywt4.pdf
- http://firstreadersclub.com/mejiwodasarakifauhu6.pdf
- https://gutinevar.weebly.com/uploads/1/3/4/6/134611255/c50c144.pdf
- http://instasale.company/what_to_wear_to_a_fight_partyzizuu.pdf
- http://creampiepow.club/el_completo_manual_del_suicida_onlin3qjqd.pdf
- https://nefirekemoziwep.weebly.com/uploads/1/3/4/3/134332842/mifafiwa.pdf
- https://najusijas.weebly.com/uploads/1/3/5/4/135400897/nuxidopute.pdf
- http://arthromedro.xyz/defiant_outdoor_light_sensing_timer_instructions7uzhp.pdf
- http://helpverifedbadges.com/xuzuzewodujw6nw.pdf
- https://titawijuneve.weebly.com/uploads/1/3/4/0/134012454/1338978.pdf
- https://raxagipob.weebly.com/uploads/1/3/4/8/134883443/2278467.pdf
- https://fobolobal.weebly.com/uploads/1/3/4/3/134317950/9809415.pdf
- http://idealslim-italiaofficial.site/rilatevimurukivujedipevu6n9rs.pdf
- https://sajoviginuxux.weebly.com/uploads/1/3/2/7/132712139/06022d.pdf
- https://vagobodowi.weebly.com/uploads/1/3/4/6/134600101/bosekenikedez-sujudib-dagag-lekifu.pdf
- https://wadasazaba.weebly.com/uploads/1/3/3/9/133999184/mavodi.pdf
- http://keepqifi.site/nature_ralph_waldo_emerson_annotatedtnfcv.pdf
- https://surutadalonuta.weebly.com/uploads/1/3/1/4/131455158/cf8da.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/00768935-7278-442d-b662-32301150360b/98055874416.pdf
- https://uploads.strikinglycdn.com/files/aaf96d1b-16b6-4093-b1ec-3a9b54e4396b/rekodu.pdf
- https://uploads.strikinglycdn.com/files/c14c882b-260f-45a2-8407-d4c9971e2cc0/cognitive_behavioral_therapy.pdf
- https://uploads.strikinglycdn.com/files/1bb18b10-4d98-4a35-ae83-767f891de9a2/old_yeller_book_characters.pdf
- https://uploads.strikinglycdn.com/files/4e78a6cb-1d0f-4959-9a9a-e0ca95bc3ce7/motorcycle_diaries_book_vs_movie.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e335.bincfa7b8d4cbc1e58c259af095e62ed760cfc9b81cff1cca9072acc4684c06b306 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE335 | 67284 bytes |
font_01_sfnt_off0001ad92.bin2ecc466bfe5c94ab4f9fa4dba0687377fc1a776cc91ccaf5390489b969198196 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1AD92 | 5068 bytes |
font_02_sfnt_off0001bef8.binbc98700b4108d501d670fd4d23efa642e7d2d4ed0bedb5501b3eca5022f83d30 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1BEF8 | 10348 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.