MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9990
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://midufefew.ru/strik?utm_term=two+stages+of+industrial+revolution PDF link annotation
- https://static.s123-cdn-static.com/uploads/4409396/normal_60009fa564186.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4476294/normal_5fd672b60238c.pdfIn PDF document text
- https://goneduxif.weebly.com/uploads/1/3/0/9/130969586/tanutomi_segatotiso_gibowunoralo.pdfIn PDF document text
- https://durabikat.weebly.com/uploads/1/3/4/5/134512276/8811483.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4489042/normal_605aa460ba9d3.pdfIn PDF document text
- https://dizoxagesok.weebly.com/uploads/1/3/4/3/134363212/sipoga.pdfIn PDF document text
- http://tojasojula.iblogger.org/whatsapp_plus_apk_latest_version_6._60.pdfIn PDF document text
- http://visumetanopigi.iblogger.org/sistema_de_tratamiento_de_aguas_residuales_por_lodos_activados.pdfIn PDF document text
- https://pozimifekof.weebly.com/uploads/1/3/4/6/134674510/4ee9d6a866.pdfIn PDF document text
- https://xosofanukofupa.weebly.com/uploads/1/3/4/8/134879033/61659f04e.pdfIn PDF document text
- https://nilesezijifata.weebly.com/uploads/1/3/4/8/134885493/f3d74168504.pdfIn PDF document text
- https://xuboxale.weebly.com/uploads/1/3/1/4/131452808/libigufe-zumamobirun-jupof-zumiwopod.pdfIn PDF document text
- https://zolivapodi.weebly.com/uploads/1/3/5/3/135313307/pedulopifugosas_jaweruz_fujorovojo.pdfIn PDF document text
- https://mubazujozij.weebly.com/uploads/1/3/4/7/134705676/9582035.pdfIn PDF document text
- https://pefisidedufe.weebly.com/uploads/1/3/4/9/134902532/473092.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://xuvunemomot.epizy.com/1078287640.pdfIn PDF document text
- https://s3.amazonaws.com/tobovunoberiki/self_certification_form_2019.pdfIn PDF document text
- https://s3.amazonaws.com/rabewiruzitewa/62362431963.pdfIn PDF document text
- https://s3.amazonaws.com/gotitibekovi/11612466584.pdfIn PDF document text
- http://vosolapigufax.epizy.com/remodel_budget_spreadsheet_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/63e4a776-5617-4fab-acf7-81a0cfe351f4/the_neverending_story_book_reading_level.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3512d94d-6aba-472b-ab17-9d8e91048573/tp-link_tl-wr841nd_v3_firmware.pdfIn PDF document text
- http://ditejadidoxe.epizy.com/what_course_is_computer_programming.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9117379e-18f4-4bf7-bbac-edbcfa4a2800/brandon_lee_boxer_wikipedia.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef2f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF2F | 5060 bytes |
SHA-256: a5f71ea47d69f8b664af0df136476271ec7cc2d8779fa7a2b9b854f6ed345bf1 |
|||
font_01_sfnt_off00010084.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10084 | 10208 bytes |
SHA-256: 1c6daf54f03aefae2c2466516ec9893a8a605ba6a6c6e2bbc24427b446e93c53 |
|||
font_02_sfnt_off0001236a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1236A | 4324 bytes |
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.