MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9989
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fokemale.ru/strik?utm_term=h%25E1%25BB%258Dc+ch%25C3%25BA+l%25C4%2583ng+nghi%25C3%25AAm+ti%25E1%25BA%25BFng+ph%25E1%25BA%25A1n PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://b9eb3541-094c-4606-b101-17c2291fd6e1.filesusr.com/ugd/a18601_41faf87e579d45eaae78e6ae45ed73af.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/kitakilesa/lowrance_hook_5_hdi_depth_finder.pdfIn PDF document text
- https://b3dfd9c9-1030-471f-a26d-814ea73dbccc.filesusr.com/ugd/d97afa_6923c7ea61214288824fe67012190c45.pdf?index=trueIn PDF document text
- https://e0220c8c-c322-4c33-af83-7c5b0fe00b66.filesusr.com/ugd/a771bd_96f79048692f46769cd51eb49494ad35.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/b484eb56-ef8e-4f19-a081-74005a7f3cfc/what_is_agile_cycle_time.pdfIn PDF document text
- https://s3.amazonaws.com/sonutopexaramuf/cbre_group_inc._s_annual_report.pdfIn PDF document text
- https://s3.amazonaws.com/bejenosugede/human_brain_powerpoint_template_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/543b6e60-25cb-4a4f-bdc2-7c58440fe2e0/the_chocolate_touch_book_free.pdfIn PDF document text
- https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_6c00a8e19d7948bcb000bc8792e0ffbf.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/3e3f0a15-c101-4355-b0f8-6f3de5ebc2e0/ford_6.0_diesel_fuel_system_diagram.pdfIn PDF document text
- https://5634f520-c25d-421d-ab67-3d94505d13cb.filesusr.com/ugd/1b85ab_d5cc0de47136473ea2cbb4e6c33ae3e5.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/565e5270-832f-4bb6-83e3-1a74e7c5819b/parts_diagram_for_briggs_and_stratton_engine.pdfIn PDF document text
- https://c78267de-509c-4cb0-9394-6b21b7876e04.filesusr.com/ugd/290ce3_a7ff5c26449d46f982be6505cbe64cec.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/xomepixo/formato_de_portada_de_tesis_en_word.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b60dbb4-6824-4d1e-b553-a32b41f2e17f/40890470604.pdfIn PDF document text
- https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_2f643c2548464df29a15d0a708acf2ca.pdf?index=trueIn PDF document text
- https://eed7fa7e-4f31-4ba6-8269-e73f07ac74c5.filesusr.com/ugd/93374d_6794fe7051034edb9135a358aeee5363.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/juvetaso/rusosiniderakunomaxut.pdfIn PDF document text
- https://s3.amazonaws.com/vuterijoze/cambridge_book_9_listening_test_2_answers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7bf05d77-d243-4f6a-8bef-d848b40936f2/bowajax.pdfIn PDF document text
- https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_550ab00661c44f3dabe47e32ac3e910e.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/dosalapasenow/what_is_a_good_sat_score_2020.pdfIn PDF document text
- https://s3.amazonaws.com/lopadivupudexa/85730437159.pdfIn PDF document text
- https://s3.amazonaws.com/temujonuwu/inquest_reports_online_uk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/82dd30a7-c5fd-4f42-a63b-6f28c445b931/ideas_for_christmas_table_favours.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001083d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1083D | 7764 bytes |
SHA-256: 6f7ab9132d712cd1f40d42ab3382c866a7afe3b9086831e3299929eb813d1789 |
|||
font_01_sfnt_off00012235.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12235 | 5876 bytes |
SHA-256: 996d306eef6f7879f2a14668f1d6522c4ad8687e7deb21de51451d4adf749450 |
|||
font_02_sfnt_off0001346e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1346E | 26524 bytes |
SHA-256: 031e73a2fdfb1009c068f51ae000a99aabfcf36f382c61d4b9d8c3248480afdf |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.