MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://maypoin.ru/wix?keyword=camp+st+albans+map PDF link annotation
- https://dalideno.weebly.com/uploads/1/3/5/3/135384103/6aa42b2.pdfIn PDF document text
- https://vabomunebalobi.weebly.com/uploads/1/3/1/8/131856010/8417139.pdfIn PDF document text
- https://vijidosuxidisad.weebly.com/uploads/1/3/4/3/134326963/rugapokoto-nofasefi.pdfIn PDF document text
- https://cdn.sqhk.co/saturarad/ahbrbgg/40034143681.pdfIn PDF document text
- https://xunusavijogomos.weebly.com/uploads/1/3/4/7/134702941/18fa2773.pdfIn PDF document text
- https://sozaruterir.weebly.com/uploads/1/3/0/7/130738534/1574332.pdfIn PDF document text
- https://pijetupuz.weebly.com/uploads/1/3/4/3/134351396/vejevos.pdfIn PDF document text
- https://cdn.sqhk.co/malevevipali/gXIEpp7/ticker_tape_parade_lyrics.pdfIn PDF document text
- https://cdn.sqhk.co/dibirolinu/bhdgchd/are_angie_s_list_reviews_reliable.pdfIn PDF document text
- https://kejuzeke.weebly.com/uploads/1/3/4/4/134456394/fatali_zegadajifurog_vudufikufifo_fizavavu.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0fb7cab6-bf54-4631-a58b-a3b88d63e426/63624504180.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75219435-eb18-4c39-a22c-0837cc413847/98443655278.pdfIn PDF document text
- https://6d251753-49d0-4f5b-a278-10ed1cacc9d0.filesusr.com/ugd/5c139a_c395fcb8a0a94c29a3a9dbcddd794f8f.pdf?index=trueIn PDF document text
- https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_ff790d7fdf9f4ea6afc1c021684f95a8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/15321759-70da-4cd5-b978-53d8bdf27b75/how_to_answer_verbal_reasoning_test.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4ea6c550-db65-45e5-8345-5ceaea7f8e2f/eset_smart_security_8_license_key_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/981216a6-49f8-4608-977a-b94e87430bda/que_es_denuedo_en_la_biblia.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d294764-1e5a-4c87-ac21-a2a6e16effc3/460028265.pdfIn PDF document text
- https://2791e1c6-719d-47aa-bdc5-1556df251b63.filesusr.com/ugd/7757c5_059b635b317246fca3410b386d20bf0c.pdf?index=trueIn PDF document text
- https://d5f1d3db-1598-48d0-a061-764c190a6564.filesusr.com/ugd/866690_669e885c77e045d09fdc4c11b62c7527.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1c381091-aa40-41aa-b171-f43f828a1d0a/56759815457.pdfIn PDF document text
- https://9e7b01ce-91ce-414a-93c5-ade8df4b7359.filesusr.com/ugd/cfbfd2_e9ce6866a4124b25ab1a9a3826d23a8d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/7a6ee5bb-bab1-4571-ba86-66d04fb2737b/the_great_american_songbook_jazz.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ec75.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEC75 | 4912 bytes |
SHA-256: 216658204dc07d13f6d67742cb963608d02bbed77e7fa98cb0362f828e9c479b |
|||
font_01_sfnt_off0000fd0c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD0C | 10984 bytes |
SHA-256: ded49f731df93d314c276eab8921982394e23d382827c1e07514c7cef8af0983 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.