MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=fitbit+versa+lite+vs+versa+2+dimensions PDF link annotation
- http://kakolamilasaru.medianewsonline.com/what_is_the_timeline_of_the_world.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/83f7621f-be69-4217-8fa2-efe0bc5f0a48/sony_dcr-trv280_manual_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e9ecc9d5-9b2e-49dd-a8ba-05d1c79b00ab/the_graveyard_book_graphic_novel.pdfIn PDF document text
- https://s3.amazonaws.com/sivanira/watavitoguz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ef98d88-3dd6-4c66-803f-821f1581b4c4/harga_keyboard_casio_wk_6600.pdfIn PDF document text
- https://s3.amazonaws.com/woxewiwupir/bittorrent_free_for_ios.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/144a8e13-cb54-4539-8a62-b4ebab8f292d/lights_out_movie_2016_cast.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c46c6723-5498-4375-bf29-48a1dd217fa2/must_watch_anime_series_on_netflix.pdfIn PDF document text
- https://s3.amazonaws.com/wuxupewu/cet_bed_2019_answer_key.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ed0c02e3-90e8-4bb0-a5bb-ab0e21176659/why_was_dark_angel_cancelled.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4183d72b-134b-46bb-99d5-864862ddc29f/are_arms_attractive.pdfIn PDF document text
- http://sinusisokopex.atwebpages.com/83544885080.pdfIn PDF document text
- https://c4e42e93-254c-4ba8-b495-737f84002742.filesusr.com/ugd/ddb60a_5519aeb4ed6843f09ebc811a57237481.pdf?index=trueIn PDF document text
- https://e6e31949-ba74-43ae-8e0c-2243355e89fd.filesusr.com/ugd/69e259_172b03d112ae4e72ab7c7c24106470b0.pdf?index=trueIn PDF document text
- https://caf0f927-206f-4b4e-aa34-0dd3da53679b.filesusr.com/ugd/83d902_f14af410ac8d4d01a2c542e7848cd176.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/0c298d46-c9be-4528-a991-f62249e22a15/98444001789.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b4d188c-9e99-4023-9557-9f13b2c66fa3/officejet_8600_printhead_part_number.pdfIn PDF document text
- https://b1b0174c-961c-4936-87f6-765e1132391e.filesusr.com/ugd/6cf804_61cc6361a0654389aba86b2297606ff8.pdf?index=trueIn PDF document text
- https://1580f21e-fc75-4350-9669-3be8b7525729.filesusr.com/ugd/eff6cf_42885a494f2c48959f675fac1800bb51.pdf?index=trueIn PDF document text
- http://madigekole.onlinewebshop.net/xopunexofeti.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fbe5114f-3087-430c-bef5-12bbd54b3615/best_resistance_bands_for_arms_and_legs.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb14068b-7699-4011-aaff-dc6754624e20/22387902103.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fc8d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC8D | 5256 bytes |
SHA-256: 546d8f912c1aaa4241e8069e7d4df9950ebf7781361057ca3d79b62a6fdee458 |
|||
font_01_sfnt_off00010e5f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E5F | 10812 bytes |
SHA-256: 0bf928cc60e024c1f68600b80c0e93e73907ad809bd2522a7391fc105854f42e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.