MALICIOUS
244
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ClamAV and an ML classifier, and contains numerous embedded links. Several heuristics indicate it functions as a link farm, with many links pointing to disposable hosting and one specifically identified as a known malicious redirector. The primary purpose appears to be SEO spamming or redirecting users to malicious sites, likely distributed via spearphishing.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crophysi.ru/award?keyword=allegri+miserere+mei+deus+pdf In PDF document text
- http://xovuwowim.mypressonline.com/different_types_of_actuators.pdfIn PDF document text
- http://vavexefane.mypressonline.com/quimica_inorganica_nomenclatura.pdfIn PDF document text
- http://sugoxebojun.getenjoyment.net/60724112406.pdfIn PDF document text
- http://mitimewigupito.mypressonline.com/65836052448.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/cefb05c6-a2cd-476c-8caf-28748b1d5ed7/arduino_ide_mac_m1.pdfIn PDF document text
- http://davinawoguzag.atwebpages.com/57203324987.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/861681c9-9e77-4f72-a861-c453959ceacb/how_to_do_a_manual_dispatch_army.pdfIn PDF document text
- https://d3dd75b0-514a-4dbf-a1f7-973a5b421fb1.filesusr.com/ugd/5b46ec_e8883f5d129e4478827151f1d85a2a46.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/70c2ffc3-024b-4815-88c0-820cdfce3010/dragon_age_origins_leliana_romance_bug.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/94d23313-4879-44d0-ab88-18c56bac380c/48126016925.pdfIn PDF document text
- http://tavoxelelenasi.onlinewebshop.net/ver_online_el_nombre_de_la_rosa_subtitulada_espaol.pdfIn PDF document text
- http://pikezega.epizy.com/177_mental_toughness_secrets_of_the_world_class_barnes_and_noble.pdfIn PDF document text
- http://vekabun.myartsonline.com/43356376099.pdfIn PDF document text
- http://denuvifateve.epizy.com/stacy_s_mom_parents_guide.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5878e34-ffea-4585-8f22-9bae7731fd0d/fumumowimek.pdfIn PDF document text
- https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_08c3cca08d5449fc86adc7c113c4d896.pdf?index=trueIn PDF document text
- http://furipurisebete.onlinewebshop.net/schede_didattiche_analisi_logica.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dfa89a87-a6bf-419f-a0fb-d0b938d05291/25020719054.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fbb4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBB4 | 4728 bytes |
SHA-256: e12be1952511d5f295b492114b0f12a8586f5d3a3d1217f0c3163d6d099cc704 |
|||
font_01_sfnt_off00010bc1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BC1 | 11584 bytes |
SHA-256: af07f07ce5e1c151e4200f3320dbeceac3a3d2b1cbdf34fbccca6732578ba531 |
|||
font_02_sfnt_off000131af.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x131AF | 4324 bytes |
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.