MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://leonvi.ru/award?keyword=hemolysis+of+red+blood+cells+lab+report+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4419441/normal_60500c2d0fffd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423171/normal_604f5681b902a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393483/normal_603578860f851.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469852/normal_5fe65f44d57a2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/680315fe-2ee4-437e-8ed8-f26d095c2be8/69357645184.pdfIn PDF document text
- https://s3.amazonaws.com/fikuvine/83670453932.pdfIn PDF document text
- http://razafif.epizy.com/baralimezurilesuteton.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e1ca2f11-58cf-472c-91a0-daf76cf873e7/83362086238.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e861bc90-26ef-487b-934f-6b634cd1d545/zusavufikasowevot.pdfIn PDF document text
- https://44dd6259-7513-41c7-b2f1-b2b1fc385d2e.filesusr.com/ugd/63022f_98302c584437417480acfac042e823d9.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/972827d3-b0d9-47be-8a22-82763e683ed0/83915718157.pdfIn PDF document text
- https://5bf49506-6ef1-42f8-8f90-7e3689255fd3.filesusr.com/ugd/8fe1bf_2eed7d46d6b642019dcc91a20983ec93.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/davubewu/79446280115.pdfIn PDF document text
- https://4993f9ff-345c-4c03-a8ec-d4f8dac664d6.filesusr.com/ugd/debbe1_9a54190603f0491481d4ea0451dedecb.pdf?index=trueIn PDF document text
- https://182222a4-a7a4-434f-839c-7103b506edb5.filesusr.com/ugd/224a67_4cfec83299bd494e8f79982dec564846.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/ziwuvijevo/sgx_annual_report_deadline.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/702964e2-abeb-4fb5-9b9e-ea8b923e17bc/how_he_loves_us_lyrics_and_chords.pdfIn PDF document text
- http://lipajegisuwi.rf.gd/benevolent_fund_form_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b2c1c25-a567-4035-86a4-4e5b288d91e2/83413461482.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/183bdb79-5b48-4550-a21b-b830d9194c2e/brake_buddy_stealth_reviews.pdfIn PDF document text
- http://nupakavidowux.epizy.com/blade_2_game_android_apkpure.pdfIn PDF document text
- https://7fad2989-91b8-457c-89bc-9a0e7aeef19f.filesusr.com/ugd/b03ff3_6b52f904ed534878805e162fbc153be3.pdf?index=trueIn PDF document text
- https://doi.org/10.1152/advan.00083.2016ThisIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000126be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x126BE | 5504 bytes |
SHA-256: ce68842604935e3934655e661cdc5c994605c5fe2f5ffb7dce9c7949679fc802 |
|||
font_01_sfnt_off0001395f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1395F | 11632 bytes |
SHA-256: 78bcd85ce314407960df59b9de8a868620cc289778b51ffa795240ec795a264f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.