MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nipisod.ru/strik?utm_term=how+many+quarts+of+oil+does+a+lexus+rx350+take PDF link annotation
- http://fumuroruzej.medianewsonline.com/seismic_analysis_of_structures.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://a68e2ff5-bf17-48e3-82d4-ceb975b85758.filesusr.com/ugd/760101_f846983240ae4b7884b63a518529b2b1.pdf?index=trueIn PDF document text
- https://d7504aae-3d37-493f-8789-a5629a6fcc30.filesusr.com/ugd/7ca9f5_0598ac50b5184e879959c07e1d4b7cb6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/bbce1b08-0637-466c-898b-bbd671060cd8/apply_for_food_stamps_online_at.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1f5f4546-9920-4b9b-bc0a-9a8bf7a20462/rorotobawu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5fe01778-9e2e-4792-9b21-3aecc529614e/kuvujapajosibegubazufif.pdfIn PDF document text
- https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_f18c85326a5f47989a881c91ce8de153.pdf?index=trueIn PDF document text
- https://2d130471-2a64-48ba-87cf-8f1e86c6acad.filesusr.com/ugd/9c43ec_8c692c0f6e0b49b28d8dc3e57a5ee635.pdf?index=trueIn PDF document text
- https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_9c1a87a66ec44e00a612749fa3cdbe8c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/e88f37fe-8b31-4098-8dca-5156fc62ad91/the_complete_works_of_swami_vivekananda_volume_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/beddb569-9e4e-4f90-a00f-0e6de5f16e1a/thinkpad_t430_specs_sata.pdfIn PDF document text
- http://fabedidatifi.onlinewebshop.net/acuerdo_de_paris_medio_ambiente.pdfIn PDF document text
- https://e1bd05e7-a2ed-43df-b5fc-9bc8ee0b1a84.filesusr.com/ugd/08acf3_084d1544c06348f5beabed2d7adb07e3.pdf?index=trueIn PDF document text
- http://dufobirufo.atwebpages.com/58805880853.pdfIn PDF document text
- https://a519209a-2b0a-481f-9fe9-460c873bdc80.filesusr.com/ugd/270e53_0231889f9e7848e5a08a79b9524b49e9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3023a42e-0ba5-44f6-968c-288dca2a5703/decision_tree_analysis_excel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/803110c3-e959-45cd-8ee6-cdbe138cf5f9/lart_de_la_guerre_sun_tzu_gratuit.pdfIn PDF document text
- https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_e2bf2b7d20ee452997ea9370678ab9d6.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/c6682228-dee6-4e41-ae80-bed96ca7f639/donjon_5e_spell_sheet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010b65.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B65 | 5896 bytes |
SHA-256: ba7ed180c918d193271c54c20b3a1de789a3893e3375bb55aa259cd779ea18e5 |
|||
font_01_sfnt_off00011f75.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11F75 | 11440 bytes |
SHA-256: 3b8b0e9fc968c00c76ac6a647996dddc9d3d11d888b0b420873b4ccb819607ea |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.