MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9967
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://zajinet.ru/123?utm_term=behringer+u-+phoria+um2+driver+windows+10 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4446645/normal_600dea4fc8074.pdfIn PDF document text
- https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/51867.pdfIn PDF document text
- http://samo-katim.ru/telofusubogexalz2mwd.pdfIn PDF document text
- http://thiswaytovogue.com/real_drift_car_racing_game_download_apksywpv.pdfIn PDF document text
- https://cdn.sqhk.co/semiwewedazi/jalbEuN/emergency_room_technician.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4384634/normal_5fe4e93a3a00d.pdfIn PDF document text
- https://nuguzawopaji.weebly.com/uploads/1/3/4/0/134040365/mujigop.pdfIn PDF document text
- https://cdn.sqhk.co/pedajobu/pjfjcie/smart_meters_law_california.pdfIn PDF document text
- https://wevinavuligi.weebly.com/uploads/1/3/4/5/134505150/6681c.pdfIn PDF document text
- http://secret-empire.ru/red_alert_4_download_full_version_pccpkcb.pdfIn PDF document text
- https://vumirexow.weebly.com/uploads/1/3/2/7/132740730/rirozugamirafifegux.pdfIn PDF document text
- https://cdn.sqhk.co/kurotevu/dgiiegh/68250968905.pdfIn PDF document text
- https://vezitiratad.weebly.com/uploads/1/3/1/8/131856143/vulekosekiguv-tobij-disekozapiduzul-kubiwuxoretek.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4386593/normal_6013ed78364da.pdfIn PDF document text
- http://pufegusikozig.22web.org/74179965863.pdfIn PDF document text
- http://hiziryigit.online/how_to_install_honeywell_rth2300_thermostat_with_2_wiresko8rt.pdfIn PDF document text
- http://cardioactiveufficiale.site/tabasobav31gkq.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4371267/normal_5feb7667a3ff1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/02534a09-b05f-4d16-ae0c-842ba0bd41e9/personal_microderm_elite_pro_reviews.pdfIn PDF document text
- http://sewusewevivezu.rf.gd/2329607205.pdfIn PDF document text
- http://rubuvajaroxe.epizy.com/58790938885.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0e605f7-d78c-4b75-8e90-7ca14298d3b8/did_bassanio_really_love_portia.pdfIn PDF document text
- http://laxiruzeremifam.rf.gd/ielts_speaking_part_2_questions_and_answers_top_50.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/418f1602-b34f-4dd1-8cc9-67d07a156074/landmarks_in_humanities_4th_edition_free.pdfIn PDF document text
- http://jeparilusukopof.epizy.com/geremobesev.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/135566a4-8118-4ca3-8617-3d6987a49dcf/genie_3024_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/329b66b8-b256-40b9-be5e-2a446574048a/60528233009.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010f32.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10F32 | 5900 bytes |
SHA-256: 6fb51db6cc08d5366dfa90edb6b83d23071551342d16b0d6820a8d7f7fb27c37 |
|||
font_01_sfnt_off0001233f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1233F | 10940 bytes |
SHA-256: 3ea92b910246b30948b5c0a2f71738184fc9c41c6f026a84fd359c4e9e12b75f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.