MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9994
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dafemum.ru/123?utm_term=tourism+marketing+process+pdf PDF link annotation
- https://cdn.sqhk.co/vixukose/mogiKji/demolition_derby_2_unblocked.pdfIn PDF document text
- https://cdn.sqhk.co/nabaxifow/qmXfxhd/nedopuduwe.pdfIn PDF document text
- https://cdn.sqhk.co/pujixefan/jUmhjjs/2386987841.pdfIn PDF document text
- https://cdn.sqhk.co/tinukomafiro/ja0quEl/squad_strike_4_fps_mod_apk.pdfIn PDF document text
- https://cdn.sqhk.co/xowuzaseku/WVFmjjZ/other_name_for_green_beans.pdfIn PDF document text
- https://cdn.sqhk.co/xamowepap/JGojdge/jofitanivede.pdfIn PDF document text
- https://cdn.sqhk.co/nazopekujavi/ZibidU4/slideshare_without_login.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/f9ab8042-7fc6-49df-bd33-dcb60623bc93/why_is_my_ps3_controller_buttons_not_working.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e8e04e1-608f-408a-aaf9-1cb66fd9c9e8/bram_stokers_dracula_novel_summary.pdfIn PDF document text
- https://bcd7deca-fd5d-492b-a220-d373ca515bc9.filesusr.com/ugd/12f4eb_21c8243bce5349198e55db210eddbe94.pdf?index=trueIn PDF document text
- http://jitapalerex.rf.gd/79811609739.pdfIn PDF document text
- https://a179b4bb-f9e1-4b0b-8685-f881d2afde68.filesusr.com/ugd/0fdb6d_475ae29d54b34b6cb79f5b5f44b65bfe.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/8f3fa9b8-fa53-4f1f-8792-efb10a6c31b3/how_do_i_calculate_postage_for_a_large_envelope.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4368c2d5-d9f1-429c-86dc-50c18af5848b/9301765757.pdfIn PDF document text
- http://jizabimumonox.rf.gd/vshare_helper_pc.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/58c22c02-2ce8-4ee3-ba8e-48396ba148ea/dibevajuzixamoka.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/034fd905-a745-415e-aff1-f8f7460104e6/beatles_sheet_music_for_piano.pdfIn PDF document text
- https://fb413987-6e77-4bf1-aaa6-e97eb550fbee.filesusr.com/ugd/108936_f4df224345a240e3bc36bceded5f21dd.pdf?index=trueIn PDF document text
- https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_409400aa0bc549faa5d43452808d9be8.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/06a1078e-49c2-4547-b29b-3432b2c68687/topip.pdfIn PDF document text
- http://guruwemuzotal.epizy.com/cadweld_catalogue.pdfIn PDF document text
- https://03f57db0-fbcf-46ec-8713-21b5992b8512.filesusr.com/ugd/455f95_bce65b742d3548e193809b1d86fa14ec.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000176bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x176BF | 5336 bytes |
SHA-256: c29fa17c41964daeb1183e26a76b0777b51be7d6371e0dd9829a1ca540d50aac |
|||
font_01_sfnt_off000188d0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x188D0 | 11640 bytes |
SHA-256: 4219e09992c1e77c9792f8f74706269fe00fc913f4704ba279a3bdc2e2a9f5ca |
|||
font_02_sfnt_off0001b042.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1B042 | 4324 bytes |
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.