MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file was identified as malicious by ML classifiers and ClamAV. It contains a significant number of external links, indicating it functions as a link farm. The primary URL, https://inwebjor.ru/pbw?utm_term=bleach+anime+background+music, suggests a potential lure or redirection mechanism. The presence of numerous links on disposable hosting further supports a malicious intent, likely for phishing or distributing further payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/pbw?utm_term=bleach+anime+background+music PDF link annotation
- https://cdn-cms.f-static.net/uploads/4403418/normal_60b97a4e26b72.pdfIn PDF document text
- https://kufapuruzanobe.weebly.com/uploads/1/3/4/8/134886719/loxititisu_lefidi_wexuz.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473619/normal_6056dcfc0dd79.pdfIn PDF document text
- https://dojifidixiwaji.weebly.com/uploads/1/3/4/3/134372722/2050696.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371269/normal_60657d94ae205.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455381/normal_602accb3860f3.pdfIn PDF document text
- https://mifurujuxix.weebly.com/uploads/1/3/3/9/133997148/5583837.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://sozakuvepar.pbworks.com/w/file/fetch/144556077/domexudavafenen.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a6263030-0b7a-47ce-b6ef-df657465a660/do_all_genie_garage_door_openers_have_a_learn_button.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5ba418b9-428f-4da0-a870-c709960c8d95/how_to_flush_a_ruud_tankless_water_heater.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/536ceea1-fd1a-499c-971b-b1b89b3c35b2/2011_mitsubishi_lancer_sx_sportback.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/52a54b92-aff2-4d37-b794-4b44e3599565/fundamentals_of_differential_equations_solutions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/219d2b70-6b8a-454d-958c-a1bef85f650c/platos_republic_book_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fc1ece68-f4a4-445d-9142-d54d0641b23d/62579668803.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d632d970-ed42-4b53-b75b-c51a5ca0164f/22288193325.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c460ff93-e6be-49a7-8c97-c71309b53af8/jaxefo.pdfIn PDF document text
- http://fevawigo.pbworks.com/w/file/fetch/144420378/how_to_describe_horse_sounds.pdfIn PDF document text
- http://nidibewuzi.pbworks.com/f/cml_lenders_handbook_part_2_hsbc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e3cf493-646f-4ce0-9067-ad4207fa423d/97639376948.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/085e404d-c9af-4852-bcec-e2bc5f4a3545/diwosesalasobo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000efb4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEFB4 | 5604 bytes |
SHA-256: 49b26c68c8cb2746c4e8d80345e87ba2636b3e61d79ad5a8fe7f0c8e4e23b2d0 |
|||
font_01_sfnt_off00010291.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10291 | 11620 bytes |
SHA-256: 194fab96068ed095acdc1138cdf100f2f4e856f4114dbaaa0076b3fcbe6ac34e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.